WIRTE is a threat actor group that was first discovered in 2018. They are suspected to be part of the Gaza Cybergang, an Arabic politically motivated cyber criminal group. WIRTE has been observed changing their toolkit and operating methods to remain undetected for longer periods of time. They primarily target governmental and political entities, but have also been known to target law firms and financial institutions.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Ashen Lepus |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names WIRTE, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to WIRTE. Each row shows why it was linked and where it came from.
| Type | Indicator | Linked by | Seen | Source |
|---|---|---|---|---|
| ip:port | 57.129.168.220:8444 | malware family "Havoc" | 2026-10-19 | abuse.ch ThreatFox |
| ip:port | 191.223.44.85:8443 | malware family "Havoc" | 2026-10-19 | abuse.ch ThreatFox |
| ip:port | 96.62.218.236:5902 | malware family "Havoc" | 2026-10-18 | abuse.ch ThreatFox |
| ip:port | 37.104.21.124:443 | malware family "Havoc" | 2026-10-18 | abuse.ch ThreatFox |
| ip:port | 96.62.218.236:443 | malware family "Havoc" | 2026-10-18 | abuse.ch ThreatFox |
| ip:port | 165.227.201.98:443 | malware family "Havoc" | 2026-10-15 | abuse.ch ThreatFox |
| ip:port | 165.154.227.150:80 | malware family "Havoc" | 2026-10-15 | abuse.ch ThreatFox |
| ip:port | 45.86.230.206:443 | malware family "Havoc" | 2026-10-15 | abuse.ch ThreatFox |
| ip:port | 94.49.29.166:443 | malware family "Havoc" | 2026-10-14 | abuse.ch ThreatFox |
| ip:port | 88.208.224.179:40057 | malware family "Havoc" | 2026-10-12 | abuse.ch ThreatFox |
| ip:port | 82.202.157.112:443 | malware family "Havoc" | 2026-10-10 | abuse.ch ThreatFox |
| ip:port | 5.163.189.237:443 | malware family "Havoc" | 2026-10-10 | abuse.ch ThreatFox |
| ip:port | 74.241.250.35:443 | malware family "Havoc" | 2026-10-08 | abuse.ch ThreatFox |
| ip:port | 157.137.215.66:8443 | malware family "Havoc" | 2026-10-07 | abuse.ch ThreatFox |
| ip:port | 52.246.183.133:443 | malware family "Havoc" | 2026-10-07 | abuse.ch ThreatFox |
| ip:port | 45.79.198.116:443 | malware family "Havoc" | 2026-10-07 | abuse.ch ThreatFox |
| ip:port | 64.227.35.8:443 | malware family "Havoc" | 2026-10-06 | abuse.ch ThreatFox |
| ip:port | 64.227.35.8:80 | malware family "Havoc" | 2026-10-05 | abuse.ch ThreatFox |
| ip:port | 13.233.118.170:8443 | malware family "Havoc" | 2026-10-05 | abuse.ch ThreatFox |
| ip:port | 137.184.139.185:8081 | malware family "Havoc" | 2026-10-05 | abuse.ch ThreatFox |
| ip:port | 100.57.14.236:443 | malware family "Havoc" | 2026-10-05 | abuse.ch ThreatFox |
| ip:port | 100.61.249.34:443 | malware family "Havoc" | 2026-10-04 | abuse.ch ThreatFox |
| ip:port | 137.175.102.11:443 | malware family "Havoc" | 2026-10-04 | abuse.ch ThreatFox |
| ip:port | 179.43.170.151:8443 | malware family "Havoc" | 2026-10-03 | abuse.ch ThreatFox |
| ip:port | 164.90.190.203:8090 | malware family "Havoc" | 2026-10-03 | abuse.ch ThreatFox |
| ip:port | 68.178.205.17:443 | malware family "Havoc" | 2026-10-02 | abuse.ch ThreatFox |
| ip:port | 92.51.46.35:8443 | malware family "Havoc" | 2026-10-02 | abuse.ch ThreatFox |
| ip:port | 158.94.210.16:2853 | malware family "Havoc" | 2026-10-02 | abuse.ch ThreatFox |
| ip:port | 68.178.202.150:443 | malware family "Havoc" | 2026-10-02 | abuse.ch ThreatFox |
| ip:port | 192.169.176.54:443 | malware family "Havoc" | 2026-10-02 | abuse.ch ThreatFox |
| ip:port | 13.61.179.31:443 | malware family "Havoc" | 2026-10-01 | abuse.ch ThreatFox |
| ip:port | 34.116.132.157:8444 | malware family "Havoc" | 2026-09-28 | abuse.ch ThreatFox |
| ip:port | 179.43.170.151:443 | malware family "Havoc" | 2026-09-28 | abuse.ch ThreatFox |
| ip:port | 144.172.69.79:443 | malware family "Havoc" | 2026-09-28 | abuse.ch ThreatFox |
| ip:port | 78.17.93.159:8090 | malware family "Havoc" | 2026-09-28 | abuse.ch ThreatFox |
| ip:port | 169.58.39.189:8443 | malware family "Havoc" | 2026-09-26 | abuse.ch ThreatFox |
| ip:port | 34.51.203.250:8444 | malware family "Havoc" | 2026-09-25 | abuse.ch ThreatFox |
| ip:port | 51.159.21.191:80 | malware family "Havoc" | 2026-09-23 | abuse.ch ThreatFox |
| ip:port | 162.33.177.101:443 | malware family "Havoc" | 2026-09-22 | abuse.ch ThreatFox |
| ip:port | 188.48.121.249:443 | malware family "Havoc" | 2026-09-22 | abuse.ch ThreatFox |
| ip:port | 38.60.136.202:443 | malware family "Havoc" | 2026-09-21 | abuse.ch ThreatFox |
| ip:port | 13.140.145.33:443 | malware family "Havoc" | 2026-09-21 | abuse.ch ThreatFox |
| ip:port | 45.86.229.111:40062 | malware family "Havoc" | 2026-09-21 | abuse.ch ThreatFox |
| ip:port | 132.226.198.241:80 | malware family "Havoc" | 2026-09-20 | abuse.ch ThreatFox |
| ip:port | 51.222.87.92:8089 | malware family "Havoc" | 2026-09-19 | abuse.ch ThreatFox |
| ip:port | 5.163.239.119:443 | malware family "Havoc" | 2026-09-18 | abuse.ch ThreatFox |
| ip:port | 38.242.209.29:8080 | malware family "Havoc" | 2026-09-18 | abuse.ch ThreatFox |
| ip:port | 109.205.212.241:45600 | malware family "Havoc" | 2026-09-17 | abuse.ch ThreatFox |
| ip:port | 188.166.254.199:443 | malware family "Havoc" | 2026-09-17 | abuse.ch ThreatFox |
| ip:port | 109.205.212.241:4444 | malware family "Havoc" | 2026-09-17 | abuse.ch ThreatFox |
| ip:port | 154.36.161.180:443 | malware family "Havoc" | 2026-09-16 | abuse.ch ThreatFox |
| ip:port | 57.154.15.252:443 | malware family "Havoc" | 2026-09-15 | abuse.ch ThreatFox |
| ip:port | 158.247.202.60:443 | malware family "Havoc" | 2026-09-15 | abuse.ch ThreatFox |
| ip:port | 104.248.156.16:80 | malware family "Havoc" | 2026-09-13 | abuse.ch ThreatFox |
| ip:port | 104.248.156.16:443 | malware family "Havoc" | 2026-09-11 | abuse.ch ThreatFox |
| ip:port | 191.252.184.198:1080 | malware family "Havoc" | 2026-09-06 | abuse.ch ThreatFox |
| ip:port | 20.2.140.201:8443 | malware family "Havoc" | 2026-09-02 | abuse.ch ThreatFox |
| ip:port | 49.232.135.25:8080 | malware family "Havoc" | 2026-08-26 | abuse.ch ThreatFox |
| ip:port | 93.152.223.39:28447 | malware family "Havoc" | 2026-08-22 | abuse.ch ThreatFox |
| ip:port | 95.133.166.10:80 | malware family "Havoc" | 2026-08-19 | abuse.ch ThreatFox |
| ip:port | 192.169.176.54:449 | malware family "Havoc" | 2026-08-19 | abuse.ch ThreatFox |
| ip:port | 178.128.14.67:4443 | malware family "Havoc" | 2026-08-17 | abuse.ch ThreatFox |
| ip:port | 68.183.248.32:4443 | malware family "Havoc" | 2026-08-16 | abuse.ch ThreatFox |
| ip:port | 151.236.21.109:2096 | malware family "Havoc" | 2026-07-24 | abuse.ch ThreatFox |
| ip:port | 37.235.54.142:53236 | malware family "Havoc" | 2026-07-13 | abuse.ch ThreatFox |
| ip:port | 212.46.38.117:4445 | malware family "Havoc" | 2026-07-09 | abuse.ch ThreatFox |
| ip:port | 173.249.41.141:80 | malware family "Havoc" | 2026-07-06 | abuse.ch ThreatFox |
| ip:port | 143.198.120.167:80 | malware family "Havoc" | 2026-07-06 | abuse.ch ThreatFox |
| ip:port | 107.172.22.3:443 | malware family "Havoc" | 2026-06-30 | abuse.ch ThreatFox |
| ip:port | 41.216.189.153:2096 | malware family "Havoc" | 2026-06-30 | abuse.ch ThreatFox |
| ip:port | 146.190.80.105:443 | malware family "Havoc" | 2026-06-24 | abuse.ch ThreatFox |
| ip:port | 20.39.60.137:443 | malware family "Havoc" | 2026-06-17 | abuse.ch ThreatFox |
| ip:port | 172.189.57.198:443 | malware family "Havoc" | 2026-06-07 | abuse.ch ThreatFox |
| ip:port | 142.93.88.220:443 | malware family "Havoc" | 2026-05-01 | abuse.ch ThreatFox |
| ip:port | 15.204.14.143:443 | malware family "Havoc" | 2026-02-09 | abuse.ch ThreatFox |
| ip:port | 15.204.14.143:80 | malware family "Havoc" | 2026-02-08 | abuse.ch ThreatFox |
| ip:port | 15.204.95.228:443 | malware family "Havoc" | 2026-02-08 | abuse.ch ThreatFox |
| ip:port | 154.205.145.109:2096 | malware family "Havoc" | 2025-11-10 | abuse.ch ThreatFox |
| ip:port | 51.81.171.234:443 | malware family "Havoc" | 2025-07-12 | abuse.ch ThreatFox |
| ip:port | 193.239.85.15:2083 | malware family "Havoc" | 2025-06-02 | abuse.ch ThreatFox |
| ip:port | 161.35.176.231:443 | malware family "Havoc" | 2025-05-29 | abuse.ch ThreatFox |
| ip:port | 47.83.134.97:443 | malware family "Havoc" | 2025-04-15 | abuse.ch ThreatFox |
| ip:port | 51.81.171.234:80 | malware family "Havoc" | 2025-03-06 | abuse.ch ThreatFox |
| ip:port | 15.204.95.228:80 | malware family "Havoc" | 2025-03-03 | abuse.ch ThreatFox |
| ip:port | 54.95.208.190:80 | malware family "Havoc" | 2025-02-19 | abuse.ch ThreatFox |
| ip:port | 54.95.208.190:443 | malware family "Havoc" | 2024-12-24 | abuse.ch ThreatFox |
| ip:port | 164.92.79.49:443 | malware family "Havoc" | 2024-01-13 | abuse.ch ThreatFox |
| ip:port | 161.35.239.147:443 | malware family "Havoc" | 2024-01-10 | abuse.ch ThreatFox |
| ip:port | 77.74.208.123:443 | malware family "Havoc" | 2023-08-25 | abuse.ch ThreatFox |
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.