GINC Technology
GINC-APT-0020 · State

Stealth Falcon

Also Daffodil Gust, Fruity Armor, FruityArmor, G0038, Project Raven, Stealth Falcon, FruityArmor.

Category
State · Attributed to a state or working for one.
Origin
United Arab Emirates(high confidence)
Sponsor
United Arab Emirates
Motivation
Espionage; Information theft and espionage
Seen
2012–2026
Status
Active
ATT&CK
G0038 · 16 techniques
Sources
13 sources carry it
Identifier
GINC-APT-0020 · stealth-falcon

What it is

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

MITRE ATT&CK
G0038
Other names
Daffodil Gust, Fruity Armor, FruityArmor, Project Raven, Stealth Falcon, FruityArmor

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Targets

Countries
Netherlands, Saudi Arabia, Thailand, United Arab Emirates, United Kingdom
Sectors
Activists, Civil society, Dissidents, Journalist

Tools

The tools and malware families the sources tie to it.

  • 0-day exploits
  • 0day CVE-2018-8453
  • CVE-2018-8611
  • Deadglyph
  • MS16-120 / CVE-2016-3393 0day exploits
  • PowerShell backdoor
  • StealthFalcon

Sources