MalwareUsed by 1 actor

ViperRAT

ViperRAT is an Android surveillance malware family associated with the threat actor APT-C-23, also known as Arid Viper or Desert Falcon. It has been used in targeted espionage operations, including activity aimed at members of the Israeli Defense Forces, and is part of a broader cluster of evolving mobile tooling linked to that actor, alongside families such as VAMP, FrozenCell, DesertScorpion, and GnatSpy.

ViperRAT is designed for covert collection of sensitive data from compromised Android devices. Documented capabilities include harvesting SMS messages, contact lists, call logs, device photos, PDF and Office documents, browser history, browser bookmarks, system metadata such as brand, manufacturer, and serial number, and network or subscriber-related information including phone number and mobile operator details. It also supports use of the device camera to take photos, indicating a surveillance role beyond simple data theft.

The malware has used masquerading as a defense-evasion and social-engineering tactic. Its second stage has been observed posing as benign update-themed applications, including messaging-app and system-update lures, to reduce user suspicion and facilitate continued operation on infected devices. This behavior aligns with APT-C-23’s broader reliance on trojanized Android applications and impersonation of legitimate software in Middle East-focused espionage campaigns.

Based on the observed functionality, ViperRAT is best characterized as Android spyware or surveillanceware focused on victim monitoring, device profiling, and exfiltration of personal and operationally relevant data from targeted users.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Arid Viper

The ever-changing malware family attributed to APT-C-23 over the years includes VAMP, GnatSpy, FrozenCell, DesertScorpion, and ViperRAT.

via about fbabout.fb.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

This spike in account creation towards the later half of 2019 was observed alongside an increase in attempts to distribute both iOS and Android malware as well as phish credentials from users.

Execution

2 techniques

T1204User ExecutionEvidence1

In all cases the successful installation of these tools did not require any exploits. This suggests that Arid Viper operators continue to heavily rely on social engineering to distribute their malware.

T1204.002Malicious FileEvidence1

Android malware was typically hosted on convincing looking attacker-controlled phishing sites.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The main changes from earlier research centered primarily around code obfuscation being added by those developing this malware.

T1036MasqueradingEvidence2

Agent Smith can impersonate any popular application on an infected device, and the core malware disguises itself as a legitimate Google application.

T1564.001Hidden Files and DirectoriesEvidence1

the values for those C2 domains first contacted weren’t hardcoded in the Java layer, where they would be clearly visible, instead they were encrypted and stored in a separate ELF binary.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

Collection

5 techniques

T1005Data from Local SystemEvidence4

Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.

T1113Screen CaptureEvidence1

The analyzed Arid Viper Android malware contained the following functionality: • Take screenshots or record video

T1123Audio CaptureEvidence1

Phenakite periodically recording audio and notifying C2 infrastructure... Similarly, Phenakite periodically uses the camera of a compromised device to take photos

T1125Video CaptureEvidence1

Phenakite periodically uses the camera of a compromised device to take photos and sends these automatically to attacker infrastructure.

T1560Archive Collected DataEvidence1

Search for files of specific types and add them to RAR archives for exfiltration

Command and Control

2 techniques

T1001Data ObfuscationEvidence1

Use Base64 to obfuscate command and control communications

T1071Application Layer ProtocolEvidence1

Some Primewire samples utilize “multipart/form-data” for command and control check-ins... other samples combine the C2 parameters into a single “application/x-www-form-urlencoded” POST body.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

uploading any files present before recursively uploading any files in subdirectories.

ACTIVITY FEED

Recent activity

19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

19 SOURCESView more in app

lookout blogNews

Jan 1, 2026

JadeRAT Mobile Surveillanceware Spikes in Espionage Activity | Threat Intel

Mobile RAT/spyware family mentioned as another targeted surveillance example.

mitre attack websiteNews

Oct 21, 2021

Capture Camera, Technique T1512 - Mobile | MITRE ATT&CK®

Android RAT capable of taking photos with the device camera.

mitre attack websiteNews

Oct 21, 2021

Capture SMS Messages, Technique T1412 - Mobile | MITRE ATT&CK®

Mobile RAT capable of collecting SMS messages.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1533 - Mobile | MITRE ATT&CK®

Remote access trojan that steals documents, photos, and browser data from devices.

+15 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ViperRAT