Arid Viper disguising mobile spyware as updates for non-malicious Android applications Since April 2022, Cisco Talos has been tracking a malicious campaign operated by the espionage-motivated Arid Viper advanced persistent threat (APT) group targeting Arabic-speaking Android users.

A threat actor known as #AridViper (likely operating out of #Gaza) has been targeting users in the #MiddleEast with #spyware disguised as dating apps, dating back to November 2022.

blog.talosintelligence.com/arid-viper-m...

🌍 First exposed by Trend Micro in February 2015, #AridViper was observed by cybersecurity vendors carrying cyber espionage operations on Palestinian and foreign targets, primarily in Israel and the Middle East.

#AridViper leverages Windows-based, iOS and Android malware.

AridViper, an intrusion set allegedly associated with Hamas Find out more about AridViper intrusion set and its affiliation with Palestinian militant organisation Hamas. Learn about its cyberespionage activities against Israel and any entity in the Middle East...

🔍 We recently conducted an in-depth analysis of #AridViper, an intrusion set believed to have ties with #Hamas. Also known as APT C-23, #MoleRATs, #GazaCyberGang, or #DesertFalcon, AridViper has been reportedly active since 2012.

blog.sekoia.io/aridviper-an...

#CTI #APT