apt

Arid Viper (APT-C-23 / Desert Falcon)

active · last signal 2y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

APT-C-23Desert FalconMantisGrey KarkadannTwo-tailed ScorpionTAG-63Big Bang APT

Attribution

Suspected Hamas-aligned / Palestinian-nexus cyber-espionage actor (attribution assessed, not confirmed by a government)

Origin

Palestinian Territories (suspected)

First seen

2014

Last active

2025

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Palestine, Egypt, Israel, Jordan, Saudi Arabia, UAE, Morocco, Qatar

Sectors

Government, mobile/individual targets, civil registry services, critical infrastructure, oil & gas, defense, media

MITRE ATT&CK

G1028 ↗

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Palestine, Egypt, Israel (Government, mobile/individual targets, civil registry services sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Domestic KittenactorTechnique overlap
Madi / MahdiactorTechnique overlap
OilAlphaactorTechnique overlap
Dark CaracalactorTechnique overlap
Rocket KittenactorTechnique overlap
Infy / Prince of PersiaactorTechnique overlap
APT39 / ChaferactorTechnique overlap
WIRTEactorTechnique overlap
Imperial Kitten (CURIUM)

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Arid Viper (APT-C-23 / Desert Falcon)'s techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

11 / 31

Mean robustness (of covered)

Useful?