APT-C-23

Also known as: APT-C-23, APT_C_23, Arid Viper, AridViper, Bearded Barbie, Big Bang APT, Desert Falcon, Grey Karkadann, Mantis, TAG-63, Two-tailed Scorpion

APT-C-23 is a threat group that has been active since at least 2014. symantec_mantis APT-C-23 has primarily focused its operations on the Middle East, including Israeli military assets. APT-C-23 has developed mobile spyware targeting Android and iOS devices since 2017. welivesecurity_apt-c-23

🌍 Country Palestine
🎯 Incident Type Espionage
🧭 ATT&CK G1028
Government Defense Energy Finance Education High-Tech Telecoms Transportation Media NGOs Civil Society Legal Military

Targeted Victims

United States Israel Palestine Middle East Europe

Associated Operations

Bearded Barbie Operation Bearded Barbie

Introduction

APT-C-23 is a threat group that has been active since at least 2014. symantec_mantis APT-C-23 has primarily focused its operations on the Middle East, including Israeli military assets. APT-C-23 has developed mobile spyware targeting Android and iOS devices since 2017. welivesecurity_apt-c-23

Activities and Tactics

Targeted Sectors: Government, Defense, Energy, Finance, Education, High-Tech, Telecoms, Transportation, Media, NGOs, Civil Society, Legal, Military

Country of Origin: 🏳️ Palestine

Incident Type: Espionage

Suspected Victims: United States, Israel, Palestine, Middle East, Europe

Notable Campaigns

  • Bearded Barbie
  • Operation Bearded Barbie

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • KASPERAGENT and MICROPSIA:
  • Desert Scorpion:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: Palestine Additional attribution information pending cataloguing.

References

[1] mitre-attack [8] fb_arid_viper Flossman, M., Scott, M. (2021, April). Technical Paper // Taking Action Against Arid Viper. Retrieved November 17, 2024. [9] sentinelone_israel_hamas_war Hegel, T., Milenkoski, A. (2023, October 24). The Israel-Hamas War | Cyber Domain State-Sponsored Activity of Interest. Retrieved March 4, 2024. [10] checkpoint_interactive_map_apt-c-23 Kayal, A. (2018, August 26). Interactive Mapping of APT-C-23. Retrieved March 4, 2024. [11] welivesecurity_apt-c-23 Stefanko, L. (2020, September 30). APT‑C‑23 group evolves its Android spyware. Retrieved March 4, 2024. [12] symantec_mantis Symantec Threat Hunter Team. (2023, April 4). Mantis: New Tooling Used in Attacks Against Palestinian Targets. Retrieved March 4, 2024.