Project Raven

Project Raven, also known as Stealth Falcon or FruityArmor, is a threat actor linked to the United Arab Emirates (UAE), identified by cybersecurity researchers as being active since 2012. This group has been associated with state-sponsored cyber-espionage activities, primarily targeting political activists, journalists, and dissidents in the Middle East. The group's operations have been attributed to various malicious activities, including the deployment of the Deadglyph malware. The group's tactics, techniques, and procedures (TTPs) align closely with those of another threat group, leading to suggestions that they may be one and the same. In January 2019, Reuters published an investigative report on Project Raven, revealing it as an initiative employing former NSA operatives and focusing on similar target demographics as Stealth Falcon. This revelation stirred significant attention in the cybersecurity community, with several analysts and organizations, including Claudio Guarnieri, drawing connections between Stealth Falcon and Project Raven based on overlapping targets and tactics. Amnesty International, based on reports referring to the same targets and attacks, concluded in 2019 that Stealth Falcon and Project Raven are indeed the same group. This conclusion was further supported by ESET, attributing the attacks to Stealth Falcon, aka Project Raven. If these findings hold true, it would signify that a single entity has been conducting a multi-faceted cyber-espionage campaign under different aliases, underscoring the complex and evolving landscape of state-sponsored cyber threats.