Arid Viper

Arid Viper, also known as APT-C-23, Desert Falcons, or Two-tailed Scorpion, is a cyber espionage group that has been active since at least 2013, primarily targeting countries in the Middle East. The group's geographical location remains unknown, but it is associated with Palestinian interests and is believed to be linked to Hamas, based on the quality of its malware and the sophistication of its social engineering tactics. The group was first reported by Meta Threat Investigators in 2020, and it has since been linked to numerous cyber attacks, including an espionage campaign targeting Android devices using the SpyC23 malware, which began in October. The Arid Viper group has demonstrated its ability to adapt and evolve its techniques over time. A notable example was discussed in the VB2023 paper titled "Reinventing the steal: Arid Viper now with a Rusty flavour," which detailed the group's use of a unique, malicious JavaScript file named myScript.js for distributing the AridSpy malware. This method was previously linked to Arid Viper by 360 Beacon Labs and the FOFA network search engine. Furthermore, researchers have discovered a striking resemblance between Arid Viper's mobile malware and a legitimate dating application called Skipped, indicating a sophisticated approach to disguising their malicious activities. Despite the extensive research into Arid Viper's activities, several mysteries remain, including a possible connection between the threat actor and the Israel-Hamas conflict. The group has shown a propensity for targeting organizations in Palestine and Egypt, aligning with some of Arid Viper's typical targets. Additionally, the same IP address used by the DPRK-linked threat actor between January and May 2022 was previously used by Arid Viper/Desert Falcon APT in 2020. This suggests potential collaborations or overlaps among different threat actors, adding another layer of complexity to the understanding of this group's operations and motivations.