- Category
- State · Attributed to a state or working for one.
- Origin
- Palestine(high confidence)
- Sponsor
- Hamas
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2011–2026
- Status
- Active
- ATT&CK
- G1028 · 3 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0075 · apt-c-23
PalestineWhat it is
APT-C-23 is a threat group that has been active since at least 2014. APT-C-23 has primarily focused its operations on the Middle East, including Israeli military assets. APT-C-23 has developed mobile spyware targeting Android and iOS devices since 2017.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Desert Falcon, Renegade Jackal
- Microsoft
- Pinstripe Lightning
- Recorded Future
- TAG-63
- Operations
- Operation “Arid Viper”, Operation “Bearded Barbie”, Operation “Rebound”
- Other names
- AridViper, Desert Falcons, APT_C_23, Arid Viper, ATK 66, Bearded Barbie, Big Bang APT, Grey Karkadann, Mantis, Niobium, Scimitar, TAG-CT1, Two-tailed Scorpion
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTno origin
- MISP Galaxy (CFR tagging)Palestine
- ThreatActor.info (Malpedia et al.)Palestine · high
Targets
- Countries
- Albania, Algeria, Australia, Belgium, Bosnia and Herzegovina, Canada, China, Cyprus, Denmark, Egypt, Europe, France, Germany, Greece, Hungary, India, Iran, Iraq, Israel, Italy, Japan, Jordan, Kuwait, Lebanon, Libya, Mali, Mauritania, Mexico, Middle East, Morocco, Netherlands, Norway, Pakistan, Palestine, Portugal, Qatar, Romania, Russia, Saudi Arabia, South Korea, Sudan, Sweden, Syria, Taiwan, Türkiye, Ukraine, United Arab Emirates, United States, Uzbekistan, Yemen, Zimbabwe
- Sectors
- Civil Society, Critical infrastructure, Defense, Education, Energy, Finance, Government, High-Tech, Legal, Media, Military, NGOs, Telecoms, Transportation
Tools
The tools and malware families the sources tie to it.
- Desert Scorpion
- FrozenCell
- KASPERAGENT and MICROPSIA
- Micropsia
- Phenakite
- SpyC23
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net