How to develop MoleRats defensive strategies: hunt, counterattack and adversary simulation

Friday 6 October 09:30 - 10:00, Red room

Shengbin Bao (Zhongfu Info)

The MoleRats threat actor, also known as Gaza Cybergang Group1 and Operation Molerats, is a politically motivated Arabic-language cyber threat actor, actively targeting the Middle East and North Africa regions, in particular the Palestinian territories.

During the past year, we have been able to hunt some special clusters of the group’s activities in the Palestinian territories. These operations not only targeted computers, but also Android devices with what was found, after analysis, to be a new mobile spyware.

After discovering its core infrastructure, we counterattacked the infrastructure and found the VCF files of the 19 attackers behind MoleRats.

Next, through cyber-HUMINT and IMINT analysis, we found the attackers' personal information and discovered some of the victims. By analysing the attackers' personal information, we determined that MoleRats is located in a university in Gaza.

In this talk, we will reveal some of the fine-grained details about the espionage story that underlies our investigation. We will focus on the threat hunting, cyber-HUMINT, IMINT and adversary simulation (Windows & Android platforms) of the group’s arsenal through analysis notes and the investigation timeline. We will also discuss developing a MoleRats defence strategy.

Shengbin Bao Shengbin Bao (@BaoshengbinCumt) is a senior security researcher at Zhongfu Info's YuanHeng Lab, based in China. After previously working as a researcher in Trend Micro’s malware research team and Qihoo 360's BAS (Breach & Attack Simulation) team, he is focused mainly on threat hunting and BAS, digging up its underlying stories and profiling the actors behind it. Today he is tasked with breaking down implants and campaigns in the realm of APT and putting it all into intelligence reports for Zhongfu’s customers. Shengbin has previously presented some of his work at security conferences including Virus Bulletin, Kanxue, KCon and ISC. @BaoshengbinCumt

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers