Stealth Falcon

Techniques (MITRE ATT&CK)16

SourceMITRE ATT&CK

State sponsor: United Arab EmiratesAttribution confidence: 50%Target categories: Civil society

Targeted regions: United Arab Emirates · United Kingdom

Also known as:FruityArmorG0038

Vexday analysis

Stealth Falcon é um grupo de ameaça persistente avançada (APT), identificado no MITRE ATT&CK como G0038, que realiza ataques direcionados de spyware contra jornalistas, ativistas e dissidentes emiradenses desde pelo menos 2012. Evidências circunstanciais sugerem uma possível ligação com o governo dos Emirados Árabes Unidos, embora essa associação não tenha sido confirmada. O grupo possui 16 técnicas documentadas no framework MITRE ATT&CK.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity24

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 16

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Execution

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell

Credential access

Credentials from Password Stores Credentials from Web Browsers Windows Credential Manager

Discovery

Query Registry System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery

Collection

Data from Local System

Command and control

Web Protocols Symmetric Cryptography

Exfiltration

Exfiltration Over C2 Channel

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

Stealth Falcon uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →