Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity

Check Point Research analyzes WIRTE, a Middle Eastern APT likely aligned with Hamas, documenting persistent 2024 campaigns that combine espionage (IronWind loader, Havoc backdoor) with disruptive SameCoin wiper operations against Israeli targets; the report includes technical analysis of infection chains (DLL sideloading, HTML-embedded payloads, user-agent filtered C2), detailed infrastructure and IOCs, victimology across the Palestinian Authority, Jordan, Iraq, Egypt and Saudi Arabia, and operational attribution.