Loading story…
Kaspersky reported that the Desert Falcons group carried out a targeted cyber-espionage campaign against victims in the Middle East, marking one of the first publicly documented Arabic-speaking threat actors conducting sustained regional operations. The campaign targeted individuals and organizations of intelligence interest, including political activists, military and government entities, media outlets, and other high-value targets.
The operation relied on malware and surveillance tooling designed to steal sensitive data from compromised systems and monitor victims over time. Securelist said the attackers used tailored intrusion techniques and espionage-focused implants to collect documents, communications, and other information from infected devices, underscoring a persistent threat aimed at long-term intelligence gathering rather than disruptive or destructive attacks.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Securelist published a report titled "The Desert Falcons targeted attacks," documenting the threat activity attributed to the Desert Falcons group. No additional event details are available from the provided reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026
Leaked internal documents and previously exposed operator recordings have provided an unusually detailed view into the operations of **Charming Kitten**—also tracked as **APT35**, **Phosphorus**, and **Mint Sandstorm**—an Iranian state-linked cyber-espionage group reportedly affiliated with the IRGC. The leaked cache published in late 2025 described formal command structures, campaign workflows, target lists, and attack playbooks, while earlier video footage reportedly captured operators conducting intrusions and stealing data from email accounts after accidentally exposing recordings on an internet-accessible server. Together, the materials depict a mature intelligence operation using phishing, credential harvesting, web shells, OSINT, mass scanning, and exploitation of vulnerabilities in products including `ConnectWise`, `Ivanti Connect Secure`, `PHP-CGI`, `Telerik UI`, `Confluence`, `GitLab`, `WordPress` plugins, and `Jenkins`. The exposed records indicate that APT35 conducted both targeted and opportunistic campaigns across the Middle East, including activity affecting government bodies, telecom systems, legal entities, and internet-facing infrastructure in Israel, Jordan, Afghanistan, Saudi Arabia, Turkey, and the United Arab Emirates. Reported theft included **74 GB** of data tied to Jordan-linked targets and thousands of emails from Afghan ministries. Separate infrastructure analysis in 2026 also found domains and rogue mail subdomains likely prepared for phishing against Egyptian shipping and marine services companies, with researchers linking the setup to Iran-aligned activity consistent with APT35 and suggesting possible compromise of legitimate DNS or cPanel configurations to support the operation.
Aug 15, 2026
Escalating conflict following **Operation Epic Fury** (US/Israel strikes inside Iran) has coincided with increased cyber activity targeting Middle East and adjacent interests. Proofpoint reported that Iran-aligned **TA453** (*Charming Kitten / Mint Sandstorm / APT42*) continued intelligence collection during the conflict, including a **credential-phishing** attempt against a US think tank observed on **8 March**, and noted additional campaigns against Middle East government organizations with suspected links to multiple state or state-aligned actors (including suspected attribution to **China, Belarus, Pakistan, and Hamas**). Despite reported Iranian internet shutdown measures after the initial strikes, espionage-focused operations were assessed as ongoing. Check Point Research separately identified China-linked activity targeting **Qatar**, using conflict-themed lures (e.g., fake “war news”/damage imagery) to deliver malware, including **PlugX** and **Cobalt Strike**, with tradecraft described as a multi-stage chain involving a compromised server and **DLL hijacking** via a legitimate application (*Baidu NetDisk*) to load the backdoor—highlighting rapid weaponization of breaking news to target **energy** and **military** sectors. Other items in the set were not part of this conflict-driven espionage theme: one report described a Russian-speaking **‘BlackSanta’** BYOVD-based “EDR killer” delivered via HR workflow abuse and steganographic images, and a weekly threat bulletin summarized unrelated breaches and research (e.g., AkzoNobel, LexisNexis, Wikimedia worm, TriZetto, and AI-related threats).
Jun 29, 2026