MITRE ATT&CKgroup
G0038 Stealth Falcon
- Domain
- enterprise
- Version
- 1.2
- Created
- 2017-05-31
Description
Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.
Related
Uses · MITRE ATT&CK (16)
- T1555.004 Windows Credential Manager sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1059.001 PowerShell sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1555 Credentials from Password Stores technique
- T1053.005 Scheduled Task sub-technique
- T1005 Data from Local System technique
- T1012 Query Registry technique
- T1016 System Network Configuration Discovery technique
- T1033 System Owner/User Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1059 Command and Scripting Interpreter technique
- T1082 System Information Discovery technique
References
- https://citizenlab.org/2016/05/stealth-falcon/ Citizen Lab Stealth Falcon May 2016