Loading story…
Researchers and media reports said the Hamas-linked threat group APT-C-23 targeted high-ranking Israeli officials in a spear-phishing campaign designed to steal sensitive information from government and security figures. The operation, dubbed Operation Bearded Barbie by Cybereason, used social-engineering lures and fake personas to build trust with targets before delivering malware and harvesting data from compromised devices.
The campaign was attributed to a Palestinian cyber-espionage actor also tracked as Arid Viper, with reporting indicating the activity focused on Israeli public-sector and political targets. The operation combined tailored phishing messages, fraudulent online identities, and mobile-focused surveillance tooling to gain persistent access and collect intelligence, underscoring the group’s continued use of espionage tactics aligned with regional geopolitical interests.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
The Register reported on the Hamas-linked espionage campaign targeting high-ranking Israeli officials, reflecting public reporting of the same operation and its focus on senior Israeli figures. This was a later report on the campaign rather than a distinct new incident.
Cybereason reported that Hamas-linked threat group APT-C-23 conducted a campaign dubbed 'Operation Bearded Barbie' targeting Israeli government, military, and related officials with social-engineering lures and malware. The activity was described as an espionage operation focused on high-ranking Israeli targets.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcetheregister.com
Open sourcecybereason.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A spearphishing campaign compromised at least 15 Israeli defense-related computers after targets received a spoofed email posing as a message from Israel's Shin Bet security service. The lure referenced the death of former Prime Minister Ariel Sharon and carried a malicious attachment that installed **Xtreme RAT**, giving attackers temporary remote control, the ability to execute commands, steal information, and potentially spread further inside affected networks. Researchers at Seculert said one confirmed victim was Israel's Civil Administration, the agency that manages Palestinian movement and entry permits, while other affected systems were reported to belong to suppliers connected to the Israeli defense forces. The company said it disrupted the operation by sinkholing the malware, but the full scope of data access and lateral movement was not publicly confirmed. Investigators said the campaign resembled a 2012 attack on Israeli government targets, with some assessments pointing to likely pro-Palestinian hackers, though attribution remained unconfirmed.
Jun 29, 2026
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026
Israeli investigators and multiple security firms reported that Hamas-linked operators ran a sustained mobile espionage campaign against Israeli soldiers by posing as attractive women on social media and persuading targets to install malicious Android apps. The lures included dating, World Cup, and other themed applications, and the operation reportedly compromised hundreds of devices before being disrupted. Israeli authorities tied the activity to Hamas, while private-sector researchers linked it with medium to high confidence to **APT-C-23**/**Arid Viper** based on targeting patterns, infrastructure, and tradecraft. The malware was packaged in apps such as **GrixyApp**, **ZatuApp**, and **Catch&See**, then used fake error messages to reduce suspicion while hiding its icon and continuing to run in the background. Researchers said the implants harvested phone numbers, email addresses, SMS messages, location data, installed-app inventories, photos, and storage details, and in some cases enabled remote access to cameras and microphones or downloaded additional payloads via DEX files. Reporting also said Hamas used related mobile collection methods, including a fitness app, to identify soldiers near the Gaza border and gather intelligence on Israeli bases and armored vehicles.
Aug 14, 2026