Stealth Falcon
MITRE ATT&CK: G0038 View on attack.mitre.org
Aliases: FruityArmor, Stealth Falcon
- First seen
- 2012-01-01 00:00:00
- Origin
- AE
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- Espionage
- Related IoCs
- 1 (1 malicious)
- Last IoC activity
- 2026-08-15 22:37:31
- Profile updated
- 2026-07-07 12:31:24
Targeted industries: media-and-entertainment education-and-nonprofits government-and-public-sector
Targeted regions: country_code:ae
Context
Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.
Recent IoC activity
1 malicious indicator in Maltiverse are attributed to Stealth Falcon (G0038). The 1 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 80e8ef78b9e28015cde4205aaa65da97.docx | 2026-08-15 | 2 |
Detection coverage
- 479 Sigma rules
Malware & tools used
- Windows Credential Manager (attack-pattern)
- Command and Scripting Interpreter (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Credentials from Password Stores (attack-pattern)
- Process Discovery (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Symmetric Cryptography (attack-pattern)
- Query Registry (attack-pattern)
- Web Protocols (attack-pattern)
- System Owner/User Discovery (attack-pattern)
- Windows Management Instrumentation (attack-pattern)
- Data from Local System (attack-pattern)
- Exfiltration Over C2 Channel (attack-pattern)
- PowerShell (attack-pattern)
- Scheduled Task (attack-pattern)
- System Information Discovery (attack-pattern)
Exploited vulnerabilities
- CVE-2019-0797 (vulnerability)
Reports & references
- citizenlab.ca — Stealth Falcon (report)
- cfr.org — Stealth Falcon (report)
- Kaspersky — 89885 (report)
- MITRE ATT&CK — G0038 (report)
- citizenlab.org — Stealth Falcon (report)