H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

IronWind

[IronWind](https://attack.mitre.org/software/S9029) is a custom loader malware that has been in use since at least 2023 by actors including [WIRTE](https://attack.mitre.org/groups/G0090) to target entities in the Middle East.(Citation: Check Point Wirte NOV 2024)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[IronWind](https://attack.mitre.org/software/S9029) is a custom loader malware that has been in use since at least 2023 by actors including [WIRTE](https://attack.mitre.org/groups/G0090) to target entities in the Middle East.(Citation: Check Point Wirte NOV 2024)

Labels

malware
10 recorded

Relationships

uses
to Command Obfuscation
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DLL
Technique
uses
to Indicator Removal
Technique
uses
to Software Discovery
Technique
uses
to System Information Discovery
Technique
uses
to System Owner/User Discovery
Technique
uses
to Web Protocols
Technique
uses
to Windows Command Shell
Technique
uses
from WIRTE
Group
2 external

References

mitre-attack
S9029
open
Check Point Wirte NOV 2024
https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance