Loading threat actor…
Arid Viper is a Palestinian cyber-espionage threat actor, widely tracked as APT-C-23 and also known as Desert Falcon, Two-tailed Scorpion, Mantis, Grey Karkadann, Big Bang APT, Renegade Jackal, Scimitar, TAG-63, Niobium, and Pinstripe Lightning. The group is commonly assessed to operate from Palestine, with multiple reports placing it in Gaza or the Palestinian territories, and some reporting linking it to Hamas or Hamas-aligned interests. Its operations are politically motivated and centered on intelligence collection and information theft in the Middle East. Arid Viper has been active since at least the mid-2010s and maintains a multi-platform malware arsenal spanning Windows, Android, and iOS. On Windows, the group is strongly associated with the Micropsia malware family and related variants including PyMICROPSIA and Arid Gopher. These implants support host reconnaissance, command execution, screenshot capture, audio recording, keylogging, browser credential theft, file collection and exfiltration, payload download, and persistence. Reporting also links the actor to additional tooling such as BarbWire and custom exfiltration utilities. On mobile platforms, Arid Viper has operated several Android spyware families including SpyC23, FrozenCell, VAMP, GnatSpy, and VolatileVenom, as well as the custom iOS surveillanceware Phenakite. Its Android malware commonly abuses accessibility services, notification access, device administrator privileges, and boot-triggered execution to maintain persistence and expand surveillance capabilities. The group relies heavily on social engineering for initial access. Documented tradecraft includes spear-phishing, politically themed decoy documents, fake social-media personas, catfishing, phishing websites, and trojanized applications masquerading as chat, dating, messaging, update, banking, or utility apps. Arid Viper has repeatedly used dedicated malware-hosting sites and direct-download infrastructure rather than broad app-store distribution, indicating selective victim targeting. Campaigns have included lures aimed at Israeli soldiers and high-profile Israeli personnel, as well as politically themed operations against Palestinian activists, officials, student groups, and organizations. Victimology is concentrated in Palestine and Israel, with recurring targeting of government officials, security forces, military personnel, law enforcement, political organizations including Fatah-linked entities, student groups, activists, and other sensitive organizations. Broader reporting also associates the actor with targeting government, military, financial, media, education, energy, and think tank sectors across the Middle East. Notable campaigns include long-running Micropsia espionage activity against Palestinian entities, Android surveillance operations against Arabic-speaking users, social-engineering campaigns against Israeli military personnel, and Operation Bearded Barbie targeting Israeli defense, law-enforcement, and emergency-services personnel. Arid Viper is notable for continuously evolving its tooling while preserving recognizable operational patterns. Researchers have documented malware development in Delphi, Python, Go, C++, and mobile-native code, frequent code overlap across families, use of decoy documents, staged payload delivery, persistence mechanisms, and modular second-stage execution. The actor has shown sustained emphasis on espionage, credential and data theft, covert mobile surveillance, and long-term access to victim environments.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
51 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
35 malware families attributed to this actor across reporting.
30 additional families tracked in Mallory.
325 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Palestinian threat actor conducting geopolitically motivated spear-phishing in the Middle East.
Cyber espionage group active since 2015 using Android and Windows malware and advanced social engineering to target journalists, human rights activists, and military groups.
Assessed as a likely operator behind a deceptive Android trojanized ‘Red Alert’ app campaign targeting people in Israel, using SMS lures impersonating Israel’s Home Front Command to drive APK installation and steal device data.
Suspected Hamas-aligned cyber-espionage activity targeting Israelis via SMS phishing that impersonates emergency alert services to deliver a trojanized Android app (spyware) capable of extensive device surveillance and credential theft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.