Stealth Falcon
Also known as FruityArmor, G0038
1mentions, 7 days
1mentions, 30 days
Nov 2, 2026last mentioned
This threat actor targets civil society groups and Emirati journalists, activists, and dissidents.
Targets: Civil society, United Arab Emirates, United Kingdom
CVEs in recent coverage
- 8.8CVE-2025-33053KEVMicrosoft Windows · 1 mention with this actor
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1005 Data from Local SystemT1012 Query RegistryT1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1041 Exfiltration Over C2 ChannelT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1057 Process DiscoveryT1059 Command and Scripting InterpreterT1059.001 PowerShellT1071.001 Web ProtocolsT1082 System Information DiscoveryT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1555.004 Windows Credential ManagerT1573.001 Symmetric Cryptography
Recent activity
- Horus Loader reverse engineering: IPfuscation, WebDAV execution and Mythic C2reddit · Nov 2, 2026
References
- https://citizenlab.ca/2016/05/stealth-falcon/
- https://www.cfr.org/interactive/cyber-operations/stealth-falcon
- https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/
- https://attack.mitre.org/groups/G0038/
- https://attack.mitre.org/groups/G0038
- https://citizenlab.org/2016/05/stealth-falcon/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.