Stealth Falcon

Techniques (MITRE ATT&CK)16

SourceMITRE ATT&CK

Vexday analysis

Stealth Falcon é um grupo de ameaça persistente avançada (APT), identificado no MITRE ATT&CK como G0038, que realiza ataques direcionados de spyware contra jornalistas, ativistas e dissidentes emiradenses desde pelo menos 2012. Evidências circunstanciais sugerem uma possível ligação com o governo dos Emirados Árabes Unidos, embora essa associação não tenha sido confirmada. O grupo possui 16 técnicas documentadas no framework MITRE ATT&CK.

Techniques (MITRE ATT&CK) 16

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Execution

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell

Credential access

Credentials from Password Stores Credentials from Web Browsers Windows Credential Manager

Discovery

Query Registry System Network Configuration Discovery System Owner/User Discovery Process Discovery System Information Discovery

Collection

Data from Local System

Command and control

Web Protocols Symmetric Cryptography

Exfiltration

Exfiltration Over C2 Channel

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Stealth Falcon uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →