Stealth Falcon

Techniques (MITRE ATT&CK)16

SourceMITRE ATT&CK

State sponsor: United Arab EmiratesAttribution confidence: 50%Target categories: Civil society

Targeted regions: United Arab Emirates · United Kingdom

Also known as:FruityArmorG0038

About the group

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity24

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 16

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Execution

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell

Credential access

Credentials from Password Stores Credentials from Web Browsers Windows Credential Manager

Discovery

Query Registry System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery

Collection

Data from Local System

Command and control

Web Protocols Symmetric Cryptography

Exfiltration

Exfiltration Over C2 Channel

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

References

Stealth Falcon uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →