Gaza cybergang is a politically motivated Arabic cybercriminal group operating in the Middle East North Africa region. The group has been operating since 2012 and became particularly active in Q2 2015. The main infection modules used by this group are common RATs: XtremeRAT and PoisonIvy. Attackers take an interest in government entities, especially embassies, where security measures and IT operations might not be well established and reliable. Use of special file names, content and domain names has helped the group perform better social engineering to infect targets.”]
Source: https://securelist.com/gaza-cybergang-wheres-your-ir-team/72283/