{
  "id": "wirte",
  "name": "WIRTE",
  "aliases": [
    "Ashen Lepus"
  ],
  "domain": "cyber",
  "country": "PSE",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [
    "PSE"
  ],
  "summary": "WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Believed subgroup of the Hamas-affiliated Gaza Cybergang",
      "src": [
        "mitre-g0090"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2018,
      "src": [
        "mitre-g0090"
      ],
      "conf": "medium",
      "note": "At least 2018"
    },
    {
      "k": "attack_id",
      "v": "G0090",
      "src": [
        "mitre-g0090"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence.",
      "src": [
        "mitre-g0090"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 26,
      "src": [
        "mitre-g0090"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "AshTag, Empire, Ferocious, Havoc, IronWind, LitePower, Rclone, SameCoin",
      "src": [
        "mitre-g0090"
      ],
      "conf": "high",
      "note": "8 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0090)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/wirte.html",
  "sources": {
    "mitre-g0090": {
      "title": "WIRTE, Group G0090",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0090/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}