Threat Investigation
Request a demo
State-sponsored

AridViper

AridViper is classified as state-sponsored.

Malware families
10
Suspected state sponsor
Palestinian Territories
Also known as
5

AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a focus on Israel and Palestine. The group employs custom-developed mobile malware, including variants like AridSpy, GnatSpy, and Micropsia, often delivered through spear-phishing emails and deceptive applications. Their operations involve sophisticated social engineering tactics, including the use of fake social media profiles and weaponized apps masquerading as legitimate services. AridViper's activities are characterized by a blend of technical sophistication and psychological manipulation, aiming to exfiltrate sensitive data from compromised systems.

The group is suspected of operating with the support of Palestinian Territories.

The group is associated with 10 malware families.

Also known as: Desert Falcon, Arid Viper, APT-C-23, Bearded Barbie, Two-tailed Scorpion

Threat Intelligence

Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.