🇦🇪

Stealth Falcon

APT Group Information theft and espionage 7 zero-day CVEs ETDA ✓

Also Known As 2 names

FruityArmor G0038

Target Countries 5

Countries highlighted in red

United Arab Emirates Netherlands Saudi Arabia Thailand United States

Sectors Targeted

Civil society groups and Emirati journalists, activists and dissidents Computer Systems Design and Related Services 54151 Employment Placement Agencies and Executive Search Services 56131

Details

Origin 🇦🇪 AE

Last Updated 01 Jun 2022

MITRE ATT&CK 45

T1005 T1007 T1012 T1016 T1027 T1033 T1036 T1041 T1047 T1053 T1053.005 T1055 T1057 T1059 T1059.001 T1059.003 T1070 T1071 T1071.001 T1082 T1090 T1095 T1105 T1106 T1112 T1127 T1134 T1140 T1204 T1218 T1480 T1518 T1546 T1547 T1553 T1555 T1555.003 T1555.004 T1562 T1566 T1573 T1573.001 T1583 T1587 T1588

Related Zero-Days 7

CVE-2025-21043 CVE-2025-33053 CVE-2025-43300 CVE-2025-49704 CVE-2025-53770 CVE-2025-55177 CVE-2025-7775

Known Names 4 entries

Stealth Falcon Citizen Lab

FruityArmor Kaspersky

Project Raven Reuters

G0038 MITRE

Observed Target Countries 5

Based on ETDA data — countries highlighted in red

Netherlands Saudi Arabia Thailand UAE UK

Description

(Citizen Lab) This report describes a campaign of targeted spyware attacks carried out by a sophisticated operator, which we call Stealth Falcon. The attacks have been conducted from 2012 until the present, against Emirati journalists, activists, and dissidents. We discovered this campaign when an individual purporting to be from an apparently fictitious organization called “The Right to Fight” contacted Rori Donaghy. Donaghy, a UK-based journalist and founder of the Emirates Center for Human Rights, received a spyware-laden email in November 2015, purporting to offer him a position on a human rights panel. Donaghy has written critically of the United Arab Emirates (UAE) government in the past, and had recently published a series of articles based on leaked emails involving members of the UAE government. Circumstantial evidence suggests a link between Stealth Falcon and the UAE government. We traced digital artifacts used in this campaign to links sent from an activist’s Twitter account in December 2012, a period when it appears to have been under government control. We also identified other bait content employed by this threat actor. We found 31 public tweets sent by Stealth Falcon, 30 of which were directly targeted at one of 27 victims. Of the 27 targets, 24 were obviously linked to the UAE, based on their profile information (e.g., photos, “UAE” in account name, location), and at least six targets appeared to be operated by people who were arrested, sought for arrest, or convicted in absentia by the UAE government, in relation to their Twitter activity.

Tools Used 3

Deadglyph StealthFalcon 0-day exploits

Operations 7

2014 Ex-NSA operatives reveal how they helped spy on targets for the Arab monarchy — dissidents, rival leaders and journalists. https://www.reuters.com/investigates/special-report/usa-spying-raven/

2016-10 Windows zero-day exploit used in targeted attacks by FruityArmor APT https://securelist.com/windows-zero-day-exploit-used-in-targeted-attacks-by-fruityarmor-apt/76396/

2018-10 Zero-day exploit (CVE-2018-8453) used in targeted attacks https://securelist.com/cve-2018-8453-used-in-targeted-attacks/88151/

2018-10 Zero-day in Windows Kernel Transaction Manager (CVE-2018-8611) https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/

2019-09 ESET researchers discovered a backdoor linked to malware used by the Stealth Falcon group, an operator of targeted spyware attacks against journalists, activists and dissidents in the Middle East. https://www.welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group/

2023 Stealth Falcon preying over Middle Eastern skies with Deadglyph https://www.welivesecurity.com/en/eset-research/stealth-falcon-preying-middle-eastern-skies-deadglyph/

2025-03 Inside Stealth Falcon’s Espionage Campaign Using a Microsoft Zero-Day https://blog.checkpoint.com/research/inside-stealth-falcons-espionage-campaign-using-a-microsoft-zero-day/

Reports & References 1

https://citizenlab.ca/2016/05/stealth-falcon/

ETDA Profile

Stealth Falcon, FruityArmor

Origin

UAE

First Seen 2012

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0038/

View on ETDA APT Groups ↗