Loading malware…
Desert Scorpion is custom Android spyware used by the Desert Falcons threat group for mobile surveillance and cyberespionage. It can retrieve SMS messages, collect contacts, enumerate installed applications, and gather attacker-specified files, including files stored on external storage. Its surveillance capabilities include recording phone calls and microphone audio, recording video, and tracking device location. It can also send SMS messages from compromised devices. Desert Scorpion collects device metadata and checks whether a device is rooted, supporting device profiling and discovery. It can delete copies of itself when additional Android application packages are downloaded to external storage, providing an indicator-removal capability.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The custom-made Android spyware used by Desert Falcons is called Desert Scorpion.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
Bahamut... employed various malware for Software Discovery, particularly to gather a list of active processes, identify installed software, and check for specific antivirus programs (T1518.001)... Desert Scorpion... view... installed apps (Software Discovery).
Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android spyware capable of recording calls and microphone audio, tracking location, and accessing contacts, messages, and installed apps.
Custom Android spyware that records calls and microphone audio, tracks location, and accesses contacts, text messages, and installed-application information.
Android malware capable of recording video.
Mobile surveillance malware capable of enumerating installed applications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.