Stealth Falcon

Stealth Falcon, also known as Project Raven or FruityArmor, is a notable threat actor that has been active since at least 2012. This group is known for its cyber espionage activities primarily in the Middle East, targeting political activists, journalists, and dissidents. The group gained significant attention in May 2016 when a new Stealth Falcon document was released. Their tactics include using unusual backdoors in their attacks on government entities, with one of the most recent examples being the novel sophisticated Deadglyph malware, as reported by The Hacker News in September 2023. There are two main hypotheses regarding the origins and sponsorship of Stealth Falcon. Hypothesis 1 suggests that Stealth Falcon is state-sponsored, with circumstantial evidence pointing towards a link between the group and the UAE government. This hypothesis is further supported by the group's consistent targeting of figures within the UAE. On the other hand, Hypothesis 2 posits that Stealth Falcon is not state-sponsored. Despite these contrasting views, there seems to be an overlapping pattern of targets and tactics between Stealth Falcon and another group called Project Raven, leading some to suggest that they might be the same entity. The connection between Stealth Falcon and Project Raven was made more explicit by Claudio Guarnieri and Amnesty International. They concluded in 2019 that Stealth Falcon and Project Raven are likely the same group, given their similar targeting and attack strategies. This conclusion was based on the observation that both groups targeted similar individuals and used similar methods, raising suspicions about their common origin. Regardless of the exact nature of their affiliation, it is clear that Stealth Falcon represents a significant and ongoing cyber threat, particularly to those in the Middle East.