H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SameCoin](https://attack.mitre.org/software/S9030) is a multi-platform wiper with Windows and Android versions that has been used by [WIRTE](https://attack.mitre.org/groups/G0090) to target entities in the Middle East including in Israel.(Citation: Check Point Wirte NOV 2024)

Labels

malware

10 recorded

Relationships

uses

to Data Destruction

Technique

uses

to File and Directory Discovery

Technique

uses

to Internal Defacement

Technique

uses

to Internal Spearphishing

Technique

uses

to Lateral Tool Transfer

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Scheduled Task

Technique

uses

to Selective Exclusion

Technique

uses

to System Location Discovery

Technique

uses

from WIRTE

Group

2 external

References

mitre-attack

S9030

Check Point Wirte NOV 2024

https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/