Arid Viper APT targets Palestine with new wave of politically themed phishing attacks, malware
Summary: Cisco Talos reports a new wave, starting around October 2021, of the Delphi-based Micropsia implant used by the Arid Viper APT group against Palestinian individuals and organizations, with politically themed file names and decoy documents drawn from Anadolu and the MA'AN development center. Talos attributes the campaign with high confidence to Arid Viper, a Gaza-based espionage group also known as Desert Falcon or APT C-23, first exposed in 2015 and reported by Talos in 2017, and says the group continues to use the same TTPs it documented then.
Key Takeaway: Talos notes that Arid Viper kept the same TTPs for four years after public exposure instead of rebuilding its infrastructure, a lack of deterrence Talos calls dangerous and a sign the current methods are working. The implant persists through a Startup-folder shortcut and runs a RAT that exfiltrates system details and screenshots to its C2 over HTTP POST.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026