Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations
Summary: Between October 2 and December 9, 2019, Unit 42 observed Molerats (Gaza Hackers Team/Gaza Cybergang) spear-phishing eight organizations in six countries across government, telecommunications, insurance and retail, delivering password-protected Word documents, a PDF, and a backdoor called Spark. The Spark payload was restricted to systems with an Arabic keyboard and locale, obfuscated with the Enigma packer, and its C2 traffic encrypted with 3DES or AES using per-payload keys, while one attack carried a payload possibly related to JhoneRAT.
What you should know: A group active since 2011 and tied to Operation Parliament is now aiming at insurance and retail targets with the same generic lures it uses on governments, and its Arabic-locale gating means an infection can sit silently on the machines it does not want - so a clean scan on an English-locale endpoint proves less than it appears.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026