Malware

Stealth Falcon

Stealth Falcon is malware associated with the Stealth Falcon intrusion activity that targeted UAE dissidents at home and abroad in a campaign spanning roughly 2012 to 2016. The activity is described as likely linked to a UAE government agency. Reported behavior includes gathering system information via Windows Management Instrumentation (WMI) and communicating with command-and-control infrastructure over HTTPS. In the described campaign, operators sent links using a fake URL shortener; the JavaScript behind those links profiled targets’ computers, checked which antivirus products were installed, and attempted to deanonymize users of Tor. High-confidence details in the provided content indicate targeting of dissidents, use of HTTPS C2, and host reconnaissance via WMI and browser-delivered profiling code.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

2 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.001PowerShellEvidence1

The content repeatedly describes threat actors and malware using PowerShell commands/scripts to download, execute, load in memory, and run payloads, e.g., "APT28 downloads and executes PowerShell scripts" and "APT3 has used PowerShell on victim systems to download and run payloads after exploitation."

Discovery

1 technique

T1082System Information DiscoveryEvidence2

"Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI."

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

citizenlabNews

Aug 24, 2016

The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender

Stealth Falcon is a threat actor and associated spyware toolkit used in targeted surveillance campaigns, primarily against UAE dissidents, journalists, and activists. It uses spearphishing, malicious documents, and custom spyware to profile and compromise targets.

mitre attackNews

Jan 25, 2026

Application Layer Protocol: Web Protocols, Sub-technique T1071.001 - Enterprise | MITRE ATT&CK®

Malware that communicates with C2 via HTTPS.

mitre attack websiteNews

Feb 3, 2026

Windows Management Instrumentation, Technique T1047 - Enterprise | MITRE ATT&CK®

Malware that uses WMI for system information collection.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping2

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Stealth Falcon