Molerats uses spearphishing, social engineering, and malware to compromise organisations for espionage and intelligence collection. The group is also associated with credential theft, persistence, and targeted data exfiltration. Defenders should watch for deceptive email entry points, unusual account activity, and outbound transfers from systems containing sensitive information.
Molerats’ Playbook: How the Group Gets Initial Access
Molerats is best understood as a politically motivated intrusion set that combines human targeting with technical delivery. Its core playbook relies on spearphishing and social engineering to get a foothold, then malware to establish control and support follow-on activity such as espionage and intelligence collection.
That mix matters because the initial compromise is usually less about a single exploit chain and more about trust abuse, convincing a target to open a message, follow a lure, or interact with content that should have been treated as suspicious.
For a broader view of how threat actors are categorized, named, and tracked across campaigns, see the Threat Actor Groups Guide.
What Molerats Typically Does After Access
Once inside, Molerats is associated with credential theft, persistence, and targeted data exfiltration. In practical terms, that means the compromise is not just about breaking in, but about staying resident, expanding access, and quietly moving selected information out of the environment.
The techniques in this phase usually support long-term collection rather than noisy destruction. Credential theft helps the actor reuse legitimate access paths, persistence helps preserve that access across restarts or cleanup attempts, and exfiltration turns the intrusion into an intelligence operation rather than a one-off breach.
Molerats’ entry methods also overlap with common phishing tradecraft, so defenders should treat suspicious messages as an attacker-controlled delivery mechanism rather than a single event. The Top 10 Phishing Techniques guide is useful for mapping lures to the patterns security teams actually need to filter, investigate, and block.
How Defenders Should Read the Tactics in Context
The useful question is not only “what did the attacker use?” but “what stage of the intrusion does that technique support?” Spearphishing and social engineering point to initial access and user deception; credential theft points to trust abuse and account takeover; persistence points to dwell time; and exfiltration points to the ultimate objective of removing sensitive data without immediate detection.
When those techniques appear together, they often indicate a campaign built for stealth and repeat access rather than a one-time smash-and-grab. That should change how teams prioritise alerts: suspicious email entry points, unusual sign-ins, access from atypical locations or devices, and outbound transfers from systems that hold sensitive information deserve the fastest review.
Risk and Threat Considerations
Molerats’ technique mix creates risk because a successful lure can hand the attacker both a foothold and a path to legitimate-looking activity. Once credentials are stolen or a user session is abused, the intrusion can blend into normal business traffic long enough for sensitive data to be collected and removed.
Failure mechanism: The attacker abuses human trust to gain entry, then uses stolen credentials or resident malware to preserve access, avoid early detection, and stage exfiltration from systems that contain valuable information.
Impact: The organisation faces espionage exposure, account compromise, and data loss, with the added problem that the most visible sign may be a normal-looking login or an outbound transfer that appears routine until it is correlated with the earlier phishing event.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Molerats uses spearphishing to gain initial access. |
| T1078 — Valid Accounts | Credential theft and follow-on access rely on abused legitimate accounts. | |
| T1041 — Exfiltration Over C2 Channel | The group’s targeted data theft depends on covert outbound transfer. | |
| Recommendation — Map lure activity to T1566 and tighten user-facing phishing detection and reporting. Hunt for abnormal use of valid accounts and revoke abused credentials quickly. Inspect outbound channels for exfiltration patterns and block suspicious data transfer paths. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Unauthorized Activities | Unusual account activity and suspicious outbound movement need continuous monitoring. |
| PR.AA-05 — Identity Management, Authentication, and Access Control | Credential theft turns account control into the attacker’s access path. | |
| Recommendation — Correlate identity, email, and network telemetry to detect unauthorized activity early. Enforce strong authentication and rapid revocation for compromised accounts. | ||
Practitioner Guidance
What to verify: Correlate mail gateway detections, identity sign-in anomalies, endpoint telemetry, and outbound traffic logs before concluding that a phishing event was contained. If the same account shows unusual access after the lure, treat it as possible credential compromise, not just message delivery.
Decision rule: If sensitive systems were reached after the initial lure, prioritise containment of the account and endpoint first, then assess whether any persistence or staged exfiltration occurred. In this pattern, “block the email” is never a complete response.
Practitioner takeaway: The key judgement is to treat the phishing email, the stolen credential, and the exfiltration event as one intrusion chain, because breaking only the first step does not remove the attacker’s later access.