Skip to content

Stealth Falcon

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.

ATT&CK ID: G0038
Techniques: 13
Tools: 0

Techniques

Execution

Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Credential Access

Credentials from Password Stores

Discovery

Query Registry System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery

Collection

Data from Local System

Command and Control

Application Layer Protocol Encrypted Channel

Exfiltration

Exfiltration Over C2 Channel

MITRE ATT&CK All threat actors