MITRE ATT&CKsoftware (malware)
S0505 Desert Scorpion
- Domain
- mobile
- Platforms
- Android
- Version
- 1.2
- Created
- 2020-09-11
Description
Desert Scorpion is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. Desert Scorpion is suspected to have been operated by the threat actor APT-C-23.
There are multiple close variants of Desert Scorpion, such as VAMP, GnatSpy, FrozenCell and SpyC23, which add some additional functionality but are not significantly different from the original malware.
Related
Uses · MITRE ATT&CK (17)
- T1644 Out of Band Data technique
- T1636.003 Contact List sub-technique
- T1636.004 SMS Messages sub-technique
- T1628.001 Suppress Application Icon sub-technique
- T1630.002 File Deletion sub-technique
- T1632.001 Code Signing Policy Modification sub-technique
- T1582 SMS Control technique
- T1532 Archive Collected Data technique
- T1533 Data from Local System technique
- T1512 Video Capture technique
- T1407 Download New Code at Runtime technique
- T1409 Stored Application Data technique
- T1418 Software Discovery technique
- T1420 File and Directory Discovery technique
- T1426 System Information Discovery technique
- T1429 Audio Capture technique
- T1430 Location Tracking technique
Referenced by MITRE ATT&CK · uses (1)
- G1028 APT-C-23 group
References
- https://blog.lookout.com/desert-scorpion-google-play Lookout Desert Scorpion
- https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/ Unit42 VAMP 2017
- https://www.trendmicro.com/en_us/research/17/l/new-gnatspy-mobile-malware-family-discovered.html Trendmicro GnatSpy 2017