Stealth Falcon

G00381 reports

aliases · Stealth Falcon

Reports

Techniques

Tactics

Countries

34%

Hunt coverage

Aliases

Analyst assessment — key judgments

Signature techniques: T1053.005 (Scheduled Task), T1560.001 (Archive via Utility), T1113 (Screen Capture).
Primary targeting: US, RU, MX, DE.
Currently dormant: 0 report(s) in last 30d vs 0 prior (+0%).
Hunt coverage 34% of 50 observed techniques (33 gap(s)).
Assessment confidence: medium (60).

Activity & trend

DormantLast 30d: 0 vs 0 prior (+0%)· first reported 2026-07-20 · last 2026-07-20

30d

90d

All

0.1

Rpts/wk

Reporting timeline · 12 months

Vulnerabilities in this actor's reporting · 3

Overview

Analyst triage

Intelligence summary

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)

Top co-occurring indicators

Aliases & naming

Targeting · countries

Targeting · named victims

ATT&CK technique matrix

Coverage vs hunt library:

—

Hunt-coverage gaps — prioritized

Top techniques by observation

T1053.005 · Scheduled Taskconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1560.001 · Archive via Utilityconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1113 · Screen Captureconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1056.001 · Keyloggingconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1027.013 · Encrypted/Encoded Fileconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1590.005 · IP Addressesconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1059.007 · JavaScriptconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1539 · Steal Web Session Cookieconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1036.007 · Double File Extensionconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1548.002 · Bypass User Account Controlconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1204.002 · Malicious Fileconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D
T1218.004 · InstallUtilconf 601
evidence: From a Single Alert to 1,000 Files: Inside an Exposed WebDAV Malware D

Threat catalogue · engineering roadmap0

Flagged detection-engineering queue

Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

Infrastructure

IOC type mix

Tooling / malware families

Relationships

Activity

30-day mention timeline

Recent reporting

Title	Source	Severity	Collected