AridViper
Also known as Desert Falcon, Arid Viper, APT-C-23, Bearded Barbie, Two-tailed Scorpion, Mantis, TAG-63, Grey Karkadann, Big Bang APT
AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a focus on Israel and Palestine. The group employs custom-developed mobile malware, including variants like AridSpy, GnatSpy, and Micropsia, often delivered through spear-phishing emails and deceptive applications. Their operations involve sophisticated social engineering tactics, including the use of fake social media profiles and weaponized apps masquerading as legitimate services. AridViper's activities are characterized by a blend of technical sophistication and psychological manipulation, aiming to exfiltrate sensitive data from compromised systems.
Targets: Government, Defense, Energy, Finance, Education, High-Tech, Telecoms, Transportation, Media, NGOs, Civil Society, Legal, Military, United States, Israel
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
Recent activity
- A Praying Mantis on security patrol (or so I hoped) while I was still picking tomatoes. # PrayingMantis # Insectsmastodon 路 Oct 30, 2026
- ---------------- 馃幆 Threat Intelligence: The Gentlemen, a cross-platform RaaS operation with a BYOVD-style EDR killer =================== Acronis' Threat Remastodon 路 Oct 28, 2026
References
- http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-arid-viper.pdf
- http://securityaffairs.co/wordpress/33785/cyber-crime/arid-viper-israel-sex-video.html
- https://securelist.com/blog/research/68817/the-desert-falcons-targeted-attacks/
- https://blog.lookout.com/blog/2017/02/16/viperrat-mobile-apt/
- https://securelist.com/blog/incidents/77562/breaking-the-weakest-link-of-the-strongest-chain/
- https://www.proofpoint.com/us/threat-insight/post/Operation-Arid-Viper-Slithers-Back-Into-View
- http://blog.talosintelligence.com/2017/06/palestine-delphi.html
- https://www.threatconnect.com/blog/kasperagent-malware-campaign/
- https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/sexually-explicit-material-used-as-lures-in-cyber-attacks?linkId=12425812
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064309/The-Desert-Falcons-targeted-attacks.pdf
- https://www.sentinelone.com/labs/gaza-cybergang-unified-front-targeting-hamas-opposition/
- https://attack.mitre.org/groups/G1028
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.