Molerats__2017__Gaza_Cybergang_-_updated_activity_in_2017_-_Securelist.pdf

Gaza cybergang, an Arabic-language politically-motivated actor active since 2012, ran targeted MENA campaigns in 2017 using spear-phishing, MS Access macros and exploitation of CVE-2017-0199 to deliver RATs (CobaltStrike, Quasar) and downloaders (Downeks), with additional traces of Android malware; the report provides detailed IOCs (domains, IPs, hashes), social-engineering lures, and mitigation recommendations.