KasperAgent
KasperAgent is a custom malware family publicly reported in 2017 in targeted attacks in the Middle East. It was documented by Palo Alto Networks Unit 42 in reporting on attacks using KASPERAGENT and MICROPSIA, and ThreatConnect linked a KasperAgent campaign to the Arid Viper threat actor. Broader reporting places Arid Viper, also known as Desert Falcon and APT-C-23, in long-running cyber-espionage operations focused largely on Israeli and Palestinian targets. The provided content does not include high-confidence technical details on KasperAgent’s internal capabilities, persistence, or command-and-control behavior. High-confidence context from the reporting indicates it was part of Arid Viper’s custom malware toolkit used in targeted regional campaigns in the Middle East alongside other malware families such as Micropsia.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In 2017, Palo Alto Networks Unit 42 reported on two malware families: KasperAgent and Micropsia, and today we still see variants of Micropsia in use.
"...to creating custom developed ones such as KASPERAGENT and MICROPSIA."
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
KasperAgent is a named malware family/tool used in targeted attacks in the Middle East and associated in the content with Arid Viper activity.
Custom-developed backdoor/tool referenced as part of Molerats' historical toolset.
Windows malware family previously reported alongside Micropsia in Arid Viper operations.
Windows malware family previously reported alongside Micropsia in Arid Viper operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.