Exploiting a path traversal vulnerability of winrar, a Molerats spear phishing campaign is discovered. It is suspected that a Gaza Cybergang group is behind the campaign. At first step, the victim installs a downloader in their operating system which then gets infected with a RAT (Quasar). The downloader typically first tries to connect to a geo location domain and then the RAT is downloaded. The given hostname serve as C2 for the molerat. There are currently three samples that contact these domains given in the IoCs, while the URL itself is marked safe.