Stealth Falcon

Stealth Falcon was first exposed by Citizen Lab in May 2016 for targeted spyware attacks on Emirati journalists, activists, and dissidents, and further detailed by ESET in 2019 (the Win32/StealthFalcon backdoor). MITRE tracks it as G0038. Reporting circumstantially links the group to the UAE government and to Project Raven — a DarkMatter-run program staffed partly by former U.S. intelligence operators, per Reuters — giving a medium-high-confidence UAE-nexus assessment, though official government confirmation is absent, a nuance preserved here.

The group's tradecraft centers on socially engineered spearphishing (including a tracking system that watermarks and monitors targets who open lure documents), followed by a custom PowerShell-based and later C-based backdoor (Win32/StealthFalcon) that uses Windows BITS for stealthy command-and-control and exfiltration — an unusual, low-visibility C2 channel. More recent research (2023-2025) has tied the cluster to continued operations abusing newly disclosed Windows vulnerabilities and a mail-server-focused implant, indicating ongoing activity.

MENA targeting is the group's defining characteristic and is unusually domestic-repressive: victims are overwhelmingly Emirati and regional dissidents, human-rights defenders, journalists, and political figures critical of the UAE government, making Stealth Falcon a leading example of a Gulf-state surveillance actor rather than a foreign-espionage APT.

Stealth Falcon is assessed as active, with recent reporting into 2024-2025 documenting new tooling and exploitation — the rare non-Iran, Gulf-origin state-aligned actor in this roster. It is included as a net-new mercenary/state-surveillance historical-through-current entry.