PSPalestine

AridViperAridViper

Also known as: Desert Falcon · Arid Viper · APT-C-23 · Bearded Barbie · Two-tailed Scorpion · AridViper

Origin
PS
Known aliases
6
Target sectors
13
Attribution
State-sponsored

Profile

AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a focus on Israel and Palestine. The group employs custom-developed mobile malware, including variants like AridSpy, GnatSpy, and Micropsia, often delivered through spear-phishing emails and deceptive applications. Their operations involve sophisticated social engineering tactics, including the use of fake social media profiles and weaponized apps masquerading as legitimate services. AridViper's activities are characterized by a blend of technical sophistication and psychological manipulation, aiming to exfiltrate sensitive data from compromised systems.

Aliases· 6

Desert FalconArid ViperAPT-C-23Bearded BarbieTwo-tailed ScorpionAridViper

Target sectors· 13

GovernmentDefenseEnergyFinanceEducationHigh-TechTelecomsTransportationMediaNGOsCivil SocietyLegalMilitary

Known victims· 5

  • United States
  • Israel
  • Palestine
  • Middle East
  • Europe

References

  1. http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-arid-viper.pdf
  2. http://securityaffairs.co/wordpress/33785/cyber-crime/arid-viper-israel-sex-video.html
  3. https://securelist.com/blog/research/68817/the-desert-falcons-targeted-attacks/
  4. https://blog.lookout.com/blog/2017/02/16/viperrat-mobile-apt/
  5. https://securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/
  6. https://www.proofpoint.com/us/threat-insight/post/Operation-Arid-Viper-Slithers-Back-Into-View
  7. http://blog.talosintelligence.com/2017/06/palestine-delphi.html
  8. https://www.threatconnect.com/blog/kasperagent-malware-campaign/

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

Actor
Pink Sandstorm
Actor
APTIran
Actor
APT-C-27
Actor
APT35
Actor
APT33
Actor
APT42
Sourced from MISP-Galaxy Threat Actor cluster. Curated by Adam Lundqvist, Founder at SQUR.