PalestineAssessedHamas-alignedEspionageActive 2014 – 2026Arid Viper
Also known asAPT-C-23 · Mantis · Desert Falcon · TAG-63 · Grey Karkadann · Big Bang APT · Two-tailed Scorpion · Pinstripe Lightning · NIOBIUM · Renegade Jackal
Summary
Hamas-aligned espionage actor (MITRE G1028 APT-C-23; also Arid Viper, Desert Falcon, Mantis) active since at least 2014, best known for building its own Android and iOS spyware and for social-engineering lures — fake dating, chat and news apps — aimed at Israeli soldiers, Palestinian Authority and Fatah-affiliated targets, journalists and dissidents. Facebook (2021) disrupted its operations from early 2019 to late 2020, which used previously unreported iOS spyware alongside Android and Windows malware. SentinelLabs tracked the SpyC23 Android family through 2022–2023; ESET attributes the AridSpy trojanised-app campaigns in Palestine and Egypt (2022 → mid-2024) to it at medium confidence. No government has attributed it; the Hamas link is a vendor assessment.
Attribution
No government attribution
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- SentinelLabs (Research, 2023-11-06)
Hamas-aligned interests - CyberScoop, reporting Facebook (Press, 2021-04-21)
Alleged Hamas-linked
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Arid Gopher against the Palestinian Authority foreign ministry | 2026-06 | Palestine | Government, Diplomatic | ESET Research (2026-10-28) — target inferred by ESET from the lure ("likely") |
| AridSpy — trojanised Android apps in Palestine and EgyptASSESSED | 2022 – 2024-06 | Palestine, Egypt | Individuals | ESET Research (2024-06-13) |
| SpyC23 Android spyware via fake chat and dating apps | 2022 – 2023 | Middle East, Israel | Individuals, Military | SentinelLabs (2023-11-06) |
| Mobile and desktop espionage against Palestinian Authority and Fatah-linked targets — disrupted by Facebook | 2019 – 2020 | Palestine | Government, Political Orgs | Facebook via CyberScoop (2021-04-21) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 2
| Initial Access1 | T1566.002Spearphishing Link |
|---|---|
| Execution1 | T1204.002Malicious File |
Malware and tools 4
| Name | Description | Platform |
|---|---|---|
| SpyC23 | Android spyware family | Android |
| AridSpy | Android trojan (trojanised apps) | Android |
| Micropsia | Windows backdoor | Windows |
| Arid Gopher | Backdoor | Windows |
Infrastructure patterns
- Long-running C2 naming scheme: hyphenated hostnames built from Western-sounding personal names (SentinelLABS, 2023)
- Arid Gopher C&C at kanreki[.]net, base64-encoded JSON traffic (ESET, 2026)
Reporting and advisories 5
- MITRE ATT&CK
APT-C-23 (G1028) group profile - SentinelLabs
Arid Viper APT's nest of SpyC23 malware - ESET Research
Arid Viper poisons Android apps with AridSpy - Meta
Taking action against hackers in Palestine (Apr 2021) - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)