Overview 96 indicators
Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.
| domain | 96 | G0038-domain.txt |
Techniques 16 ATT&CK
Open in ATT&CK Navigator → or download the layer (16 techniques, layer 4.5)
- T1005 Data from Local System
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1041 Exfiltration Over C2 Channel
- T1047 Windows Management Instrumentation
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1555.004 Windows Credential Manager
- T1573.001 Symmetric Cryptography
Principal sources 5 reports
Ranked by how many of this actor's indicators each report brought in.
- 78citizenlab.org/2016/05/stealth-falcon-appendices
- 10research.checkpoint.com/2025/stealth-falcon-zero-day
- 5welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group
- 2securelist.com/cve-2018-8453-used-in-targeted-attacks/…
- 2citizenlab.ca/2016/05/stealth-falcon
Related groups 1
What the sources have in common — not a claim that these are the same actor. See the whole graph.
Timeline 96 indicators
Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.
No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.
-
research.checkpoint.com/2025/stealth-falcon-zero-day
cyclingonlineshop.com downloadessays.net fastfilebackup.com healthherofit.com luxuryfitnesslabs.com purvoyage.com radiotimesignal.com roundedbullets.com summerartcamp.net worryfreetransport.com -
welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group
electricalweb.org footballtimes.info upnpdiscover.org vegetableportfolio.com -
securelist.com/cve-2018-8453-used-in-targeted-attacks/…
shelves-design.com weekendstrips.net -
citizenlab.ca/2016/05/stealth-falcon
adhostingcache.com incapsulawebcache.com -
citizenlab.org/2016/05/stealth-falcon-appendices
adlinkmetric.com adlinkmetrics.com adobereaderupdater.com airlineadverts.com akamai-host-network.com akamai-hosting-network.com akamaicachecdn.com akamaicloud.net akamaicss.com akamaihostcdn.net akamaiwebcache.com appleimagecache.com bestairlinepricetags.com burst-media.com cachecontent.com cdn-logichosting.com cdnimagescache.com chromeupdater.com clickstatistic.com cloudburstcdn.net cloudburstercdn.net cloudimagecdn.com cloudimagehosters.com contenthosts.com contenthosts.net dnsclienthelper.com dnsclientresolver.com domainimagehost.com dotnetupdatechecker.com dotnetupdates.com dropboxsyncservice.com edgecacheimagehosting.com fasttravelclearance.com flashplayersupdates.com flashplayerupdater.com iesafebrowsingcache.com iesaferbrowsingcache.com javaupdatecache.com javaupdatersvc.com javaupdatescache.com javaupdatesvc.com limelightimagecache.com livewebcache.com media-providers.net mediacachecdn.com mediacachecdn.net mediacloudsolution.com mediacloudsolutions.net mediaimagecache.com mediaproviders.net ministrynewschannel.com ministrynewsinfo.com msofficesso.com msofficeupdates.com mswindowsupdater.com netassistcache.com netcloudcdn.com optimizedimghosting.com optimizercache.com oraclejavaupdate.com oraclejavaupdater.com rapidlinkhit.com safeadspace.com safeadvertimgs.com simpleadbanners.com tinyimagehosting.com webanalyticstats.com wincertificateupdater.com winconnectors.com windefenderupdater.com windowsconnector.com windowsdefenderupdater.com windowshealthcheck.com windowspatchmanager.com windowssearchcache.com windowsupdatecache.com windowsupdatescache.com -
citizenlab.org/2016/05/stealth-falcon-appendices · welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group
windowsearchcache.com
Further reading 7
- attack.mitre.org/groups/G0038
- citizenlab.org/2016/05/stealth-falcon
- welivesecurity.com/2019/09/09/backdoor-stealth-falcon-group
- citizenlab.ca/2016/05/stealth-falcon
- research.checkpoint.com/2025/stealth-falcon-zero-day
- securelist.com/cve-2018-8453-used-in-targeted-attacks/…
- citizenlab.org/2016/05/stealth-falcon-appendices