S0680: LitePower
Security context for executives and security teams
LitePower matters because it is described by ATT&CK as a Windows downloader and second-stage malware associated with WIRTE. For leaders, the key risk is not a single malware name but the post-compromise pattern it represents: execution through PowerShell/native APIs, persistence through scheduled tasks, host and security-tool discovery, screen capture, web-based command-and-control, tool transfer, and exfiltration over the C2 channel.
Executive priority
Prioritize LitePower as a validation case for Windows endpoint visibility, SOC triage readiness, and incident response decision-making around suspected second-stage malware. The ATT&CK relationship to WIRTE adds threat-intelligence relevance for organizations concerned with the diplomatic, financial, military, legal, technology, Middle East, North Africa, or Europe context described for that group, but local exposure must be assessed from organizational telemetry and threat model.
Technical view
Because ATT&CK provides no dedicated detection text for LitePower, defenders should validate coverage against the related techniques: PowerShell execution, scheduled task creation or modification, registry queries, user/system/security-software/storage discovery, screen capture behavior, inbound tool transfer, web-protocol C2, and exfiltration over an existing C2 channel. Treat this as a behavior cluster rather than a signature-only malware detection problem.
Likely telemetry
- Windows endpoint process creation and command-line telemetry
- PowerShell execution logs and script-block/module logging where available
- Windows scheduled task creation, modification, and execution events
- Registry access/query telemetry
- Endpoint file creation and download evidence for transferred tools or payloads
Detection direction
- Correlate PowerShell or native execution with discovery activity, scheduled task persistence, and outbound web traffic rather than relying on one event type.
- Tune for suspicious scheduled tasks created by unusual users, paths, commands, or PowerShell-backed actions while accounting for legitimate administration software.
- Review discovery patterns involving registry, logged-on user, system information, security tools, and local storage enumeration, especially when followed by external network communication.
- Validate whether network monitoring can distinguish routine web traffic from unusual beaconing, file transfer, or data egress over HTTP/S-like channels.
- Use the WIRTE relationship as enrichment for threat intelligence and prioritization, not as proof of attribution in an incident.
Mitigation priorities
- Harden and monitor PowerShell use, including administrative baselines and logging appropriate to the Windows environment.
- Restrict and review scheduled task creation rights and maintain an auditable inventory of legitimate scheduled tasks.
- Ensure endpoint controls and SOC playbooks cover downloader and second-stage malware scenarios, including containment, payload retrieval analysis, and C2 blocking decisions.
- Apply least privilege and administrative control review to reduce the value of user, system, and security-tool discovery.
- Validate egress controls and proxy logging so web-protocol C2 and exfiltration-over-C2 behaviors can be investigated.
Additional notes and limits
LitePower is a software object, not a technique. Its practical value for defenders comes from the ATT&CK relationships to techniques it uses and the relationship indicating WIRTE use. The supplied object identifies Windows as the platform for LitePower, while several related techniques have broader platform lists; detection engineering should scope implementation to the local Windows estate unless other evidence exists.
ATT&CK provides no official detection guidance, no aliases, no labels, and no explicit tactics on the LitePower object itself. This take is based only on the supplied description, external references, and relationship context. It should not be read as evidence of current activity, customer exposure, guaranteed detection coverage, or confirmed attribution in any specific environment.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
LitePower
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1033 | System Owner/User Discovery | |
| Enterprise | T1105 | Ingress Tool Transfer | |
| Enterprise | T1012 | Query Registry | |
| Enterprise | T1059.001 | PowerShellSub-technique | |
| Enterprise | T1113 | Screen Capture | |
| Enterprise | T1106 | Native API | |
| Enterprise | T1071.001 | Web ProtocolsSub-technique | |
| Enterprise | T1041 | Exfiltration Over C2 Channel | |
| Enterprise | T1053.005 | Scheduled TaskSub-technique | |
| Enterprise | T1680 | Local Storage Discovery | |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | |
| Enterprise | T1082 | System Information Discovery |
Groups, software, and campaigns
G0090: WIRTE
WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has targeted diplomatic, financial, military, legal, and technology organizations across the Middle East, North Africa, and in Europe to gather intelligence. WIRTE has remained persistently active despite the ongoing Israel-Hamas conflict and has expanded their operations to include wiper malware attacks against Israeli targets.[1][2][3][4]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | e17a4d1b1c32… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [2]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [3]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [4]mitre-attackS0680Open source URL
- [5]mitre-attackS0680Open source URL
- [6]mitre-attackS0680Open source URL
- [7]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [8]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [9]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [10]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [11]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [12]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [13]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [14]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [15]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [16]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [17]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [18]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [19]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [20]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [21]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [22]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [23]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [24]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [25]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [26]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [27]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL - [28]Kaspersky WIRTE November 2021
Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.