AridViper

    Palestinian TerritoriesState-sponsoredUnknown

    Observation period

    0

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a focus on Israel and Palestine. The group employs custom-developed mobile malware, including variants like AridSpy, GnatSpy, and Micropsia, often delivered through spear-phishing emails and deceptive applications. Their operations involve sophisticated social engineering tactics, including the use of fake social media profiles and weaponized apps masquerading as legitimate services. AridViper's activities are characterized by a blend of technical sophistication and psychological manipulation, aiming to exfiltrate sensitive data from compromised systems.

    Relevance for Germany, Austria and Switzerland

    medium

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Government
    • Defense
    • Energy
    • Finance
    • Education
    • High-Tech
    • Telecoms
    • Transportation
    • Media
    • NGOs
    • Civil Society
    • Legal
    • Military

    Target countries according to source United States, Israel, Palestine, Middle East, Europe

    Aliases

    • Desert Falcon
    • Arid Viper
    • APT-C-23
    • Bearded Barbie
    • Two-tailed Scorpion

    Software / tooling used

    External references

    Back to group overview