APT-C-23
MITRE ATT&CK: G1028 View on attack.mitre.org
Aliases: Mantis, Arid Viper, Desert Falcon, TAG-63, Grey Karkadann, Big Bang APT, Two-tailed Scorpion, APT-C-23, Bearded Barbie
- First seen
- 2014-01-01 00:00:00
- Origin
- PS
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- Espionage
- Related IoCs
- 1 (1 malicious)
- Last IoC activity
- 2026-07-27 10:07:01
- Profile updated
- 2026-07-07 11:54:10
Targeted industries: defense-and-aerospace government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:il
Context
APT-C-23 is a threat group that has been active since at least 2014. APT-C-23 has primarily focused its operations on the Middle East, including Israeli military assets. APT-C-23 has developed mobile spyware targeting Android and iOS devices since 2017.
Recent IoC activity
1 malicious indicator in Maltiverse are attributed to APT-C-23 (G1028). The 1 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | 29ac6e5719aeb0cba63b837ca2cbdb6483044ed5a885c457f6858ae61e2dd4da | 2026-07-27 | 1 |
Malware & tools used
- System Network Configuration Discovery (attack-pattern)
- Match Legitimate Name or Location (attack-pattern)
- Phishing (attack-pattern)
- Desert Scorpion (malware)
- Micropsia (malware)
- SpyC23 (malware)
- FrozenCell (malware)
- Phenakite (malware)
Reports & references
- Trend Micro — Wp Operation Arid Viper (report)
- securityaffairs.co — Arid Viper Israel Sex Video (report)
- Kaspersky — The Desert Falcons Targeted Attacks (report)
- blog.lookout.com — Viperrat Mobile Apt (report)
- Kaspersky — Breaking The Weakest Link Of The Strongest Chain (report)
- proofpoint.com — Operation Arid Viper Slithers Back Into View (report)
- Cisco Talos — Palestine Delphi (report)
- threatconnect.com — Kasperagent Malware Campaign (report)
- Trend Micro — Sexually Explicit Material Used As Lures In Cyber Attacks (report)
- media.kasperskycontenthub.com — The Desert Falcons Targeted Attacks (report)
- sentinelone.com — Gaza Cybergang Unified Front Targeting Hamas Opposition (report)
- MITRE ATT&CK — G1028 (report)
- web.archive.org — Aptc23 Group Evolves Its Android Spyware (report)
- web.archive.org — Interactive Mapping Of Apt C 23 (report)
- web.archive.org — Technical Threat Report Arid Viper April 2021 (report)
- web.archive.org — Mantis Palestinian Attacks (report)
- web.archive.org — The Israel Hamas War Cyber Domain State Sponsored Activity Of Interest (report)
Attributed from
- Operation Bearded Barbie (campaign)
External references
- mitre-attack — G1028
- Big Bang APT
- Grey Karkadann
- Mantis
- Two-tailed Scorpion
- Arid Viper
- Desert Falcon
- fb_arid_viper
- sentinelone_israel_hamas_war
- checkpoint_interactive_map_apt-c-23
- welivesecurity_apt-c-23
- symantec_mantis
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy
- misp-galaxy