← All actors Recent activity

APT-C-23 G1028

ARIDVIPER · DESERTFALCON · arid gopher · arid viper · spyc23

Indicators
180
Source reports
34
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-01-02
20152024

Overview 180 indicators

APT-C-23 is a threat group that has been active since at least 2014. APT-C-23 has primarily focused its operations on the Middle East, including Israeli military assets. APT-C-23 has developed mobile spyware targeting Android and iOS devices since 2017.

domain103G1028-domain.txt
url_path69G1028.json
ipv46G1028.json
url2G1028.json

Techniques 3 ATT&CK

Open in ATT&CK Navigator → or download the layer (3 techniques, layer 4.5)

Software 5

Principal sources 34 reports

Ranked by how many of this actor's indicators each report brought in.

What the sources have in common — not a claim that these are the same actor. See the whole graph.

Timeline 180 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 20 domain2 yrs ago

    welivesecurity.com/en/eset-research/arid-viper-poisons-and…

    almoshell.website
    alwaysgoodidea.com
    analyticsandroid.com
    crashstoreplayer.website
    dabliardogame.com
    elsilvercloud.com
    gameservicesplay.com
    godeutalk.com
    labeepuzz.com
    nortirchats.com
    orientflags.com
    palcivilreg.com
    pariberychat.com
    proj-2bedf.firebaseio.com
    proj-54ca0.firebaseio.com
    proj-95dae.firebaseio.com
    proj3-1e67a.firebaseio.com
    project44-5ebbd.firebaseio.com
    renatchat.com
    ultraversion.com

  2. 3 domain3 yrs ago

    sentinelone.com/labs/arid-viper-apts-nest-of-spyc23-mal…

    jolia-16e7b.appspot.com
    rashonal.appspot.com
    yellwo-473d0.appspot.com

  3. 14 domain3 yrs ago

    threatfox.abuse.ch/browse/tag/AridViper

    acs-group.net
    anime-con.net
    cricket-live.net
    dslam.net
    gmesc.com
    gsstar.net
    im-inter.net
    it-franch-result.info
    jasondixon.net
    leaf-japan.net
    london-sport.ne
    lrxzklwmzxe.com
    sports-et-loisirs.net
    tophatauc.com

  4. 4 domain3 yrs ago

    blog.talosintelligence.com/arid-viper-mobile-spyware

    haroldramsey.icu
    lightroom-61eb2.firebaseio.com
    luis-dubuque.in
    skippedtestinapp.firebaseio.com

  5. 1 domain, 3 ipv4, 1 url, 6 url_path3 yrs ago

    twitter.com/k3yp0d/status/1708357733471195192 · virustotal.com/gui/file/af87a91c71b3cca1184b4b1250cace…

    domainizocraft.com
    ipv491.199.147.84:8080
    ipv491.199.147.84:8888
    ipv491.219.150.123:42530
    urlhttp://91.199.147.84
    url_path/ajgwpwtgwz/
    url_path/ittkkcoehbpgsxvol/
    url_path/ittkkcoehbpgsxvol/txizybbupgqwa/
    url_path/ittkkcoehbpgsxvol/txizybbupgqwa/ajgwpwtgwz/
    url_path/txizybbupgqwa/
    url_path/txizybbupgqwa/ajgwpwtgwz/

  6. 1 domain, 2 ipv4, 6 url_path3 yrs ago

    twitter.com/k3yp0d/status/1704818412864594156 · virustotal.com/gui/file/fa98139b94cc56890af27e6dd02deb…

    domainporthopeminorhockey.net
    ipv45.181.23.41:8000
    ipv45.181.23.41:8888
    url_path/cvmfiojusjku/
    url_path/ddtkdnjhaqvujgv/
    url_path/ddtkdnjhaqvujgv/cvmfiojusjku/
    url_path/jqfhpgbwhx/
    url_path/myucfibwza/
    url_path/uohmgcvzhl/

  7. 1 domain, 7 url_path3 yrs ago

    twitter.com/k3yp0d/status/1704053585036615861 · virustotal.com/gui/ip-address/45.144.29.251/relations · virustotal.com/gui/file/c1c5c4153fea7871e735cabaffaf64…

    domaindelooyp.com
    url_path/cdkpwwchvjjy/
    url_path/gmsvmzxrrrlt/
    url_path/ihxjkoflibjv/
    url_path/lahmrxjlpvvn/
    url_path/lwbheruavqogbr/
    url_path/ymdfckhiqjerxsww/
    url_path/ymdfckhiqjerxsww/lwbheruavqogbr/

  8. 9 domain, 1 url, 11 url_path3 yrs ago

    symantec-enterprise-blogs.security.com/blogs/threat-intelligence/mantis-palest…

    domainchloe-boreman.com
    domaincriston-cole.com
    domainjumpstartmail.com
    domainpaydayloansnew.com
    domainpicture-world.info
    domainrnacgroup.com
    domainsalimafia.net
    domainseomoi.net
    domainsoft-utils.com
    urlhttp://5.182.39.44
    url_path/AJLUK9BI48/
    url_path/AJLUK9BI48/0L6W3CSBMC
    url_path/DWL1RucGSj/
    url_path/DWL1RucGSj/4wwA7S8jQv
    url_path/IURTIER3BNV4ER/
    url_path/IURTIER3BNV4ER/AJLUK9BI48/0L6W3CSBMC
    url_path/IURTIER3BNV4ER/DWL1RucGSj/4wwA7S8jQv
    url_path/cmsnvbyawttf/
    url_path/esuzmwmrtajj/
    url_path/esuzmwmrtajj/cmsnvbyawttf/mkxnhqwdywbu
    url_path/mkxnhqwdywbu

  9. 1 domain, 1 url_path4 yrs ago

    twitter.com/RedDrip7/status/1592040235340541953 · virustotal.com/gui/file/36037040711231986f7509a2aa2af7…

    domainswsan-lina-soso.info
    url_path/QgaYCarsQS/LaVfcCBwHi/

  10. 5 url_path4 yrs ago

    twitter.com/Jup1a/status/1579751269828562945 · virustotal.com/gui/file/247bebcb221ba87b9198aa8f4102b4… · twitter.com/RedDrip7/status/1592040235340541953 · virustotal.com/gui/file/36037040711231986f7509a2aa2af7…

    /A2FwXHQqrQ2hvDc/
    /A2FwXHQqrQ2hvDc/QgaYCarsQS/
    /A2FwXHQqrQ2hvDc/QgaYCarsQS/LaVfcCBwHi/
    /LaVfcCBwHi/
    /QgaYCarsQS/

  11. 1 domain, 4 url_path4 yrs ago

    twitter.com/Jup1a/status/1579751269828562945 · virustotal.com/gui/file/247bebcb221ba87b9198aa8f4102b4…

    domainzakaria-chotzen.info
    url_path/A2FwXHQqrQ2hvDc/kRyMLhAIuQ/
    url_path/A2FwXHQqrQ2hvDc/kRyMLhAIuQ/oznLJOjxRn/
    url_path/kRyMLhAIuQ/
    url_path/oznLJOjxRn/

  12. 1 domain, 3 url_path4 yrs ago

    twitter.com/ShadowChasing1/status/15376983777142538… · virustotal.com/gui/file/8994ecf78913be242d1246637c3434…

    domainangela-bishop.com
    url_path/kRD5K9t35c78cjLV/
    url_path/yMdp2RPagaQcZYtr/
    url_path/yMdp2RPagaQcZYtr/kRD5K9t35c78cjLV/

  13. 1 domain4 yrs ago

    twitter.com/h2jazi/status/1532388531141808129 · virustotal.com/gui/file/80cff71a7f13a2e83b948ed218ab6f… · virustotal.com/gui/file/f75314cafb6f523492451b7e354353…

    sknzy-mysl.vip

  14. 2 domain4 yrs ago

    deepinstinct.com/blog/arid-gopher-the-newest-micropsia-m…

    grace-fraser.site
    mozelllittel.com

  15. 3 domain, 16 url_path4 yrs ago

    blog.talosintelligence.com/2022/02/arid-viper-targets-palestine.ht…

    domaincooperron.me
    domaindeangelomcnay.news
    domainearlahenry.com
    url_path/Ct2azbEP57LtWgmK/
    url_path/Ct2azbEP57LtWgmK/lWaPwemAJ3LPFmDH/
    url_path/GbrHoIfRqtE69hH/
    url_path/X2EYSWlzSZgSUME210Zv/
    url_path/X2EYSWlzSZgSUME210Zv/YPPV6kFl2PwwF0TEVHMy/
    url_path/YPPV6kFl2PwwF0TEVHMy/
    url_path/ZCgbo9EVhYMA8PX
    url_path/bu5EmpJE7DUfzZD
    url_path/hx3FByTR5o3zNZYD/
    url_path/hx3FByTR5o3zNZYD/sYkaiHz0Mse13C79dy1I/
    url_path/lWaPwemAJ3LPFmDH/
    url_path/qWIlIdKf2buIH0k/
    url_path/qWIlIdKf2buIH0k/GbrHoIfRqtE69hH/
    url_path/qWIlIdKf2buIH0k/GbrHoIfRqtE69hH/ZCgbo9EVhYMA8PX
    url_path/qWIlIdKf2buIH0k/GbrHoIfRqtE69hH/bu5EmpJE7DUfzZD
    url_path/sYkaiHz0Mse13C79dy1I/

  16. 1 domain4 yrs ago

    deepinstinct.com/blog/arid-gopher-the-newest-micropsia-m…

    pam-beesly.site

  17. 3 url_path4 yrs ago

    blog.talosintelligence.com/2022/02/arid-viper-targets-palestine.ht…

    /KY1hNeVvrE1XCrKP/
    /um2NxySaF4L5mSYE/
    /um2NxySaF4L5mSYE/KY1hNeVvrE1XCrKP/

  18. 1 domain5 yrs ago

    twitter.com/k3yp0d/status/1468294182829760519 · virustotal.com/gui/file/375340a79168cd4ccf7846db469ab1…

    tierrastein.live

  19. 7 domain, 5 url_path6 yrs ago

    unit42.paloaltonetworks.com/pymicropsia

    domainbaldwin-gonzalez.live
    domainbenyallen.club
    domainchad-jessie.info
    domainescanor.live
    domainjaime-martinez.info
    domainrobert-keegan.life
    domaintatsumifoughtogre.club
    url_path/sfuxmiibif/
    url_path/zoailloaze/
    url_path/zoailloaze/sfuxmiibif/
    url_path/zoailloaze/sfuxmiibif/hortense1
    url_path/zoailloaze/sfuxmiibif/qprbudls

  20. 1 ipv46 yrs ago

    twitter.com/eyalsela/status/883243599705645056

    213.184.123.144:8080

  21. 1 domain6 yrs ago

    unit42.paloaltonetworks.com/pymicropsia

    judystevenson.info

  22. 1 domain6 yrs ago

    unit42.paloaltonetworks.com/pymicropsia

    krasil-anthony.icu

  23. 1 domain6 yrs ago

    unit42.paloaltonetworks.com/pymicropsia

    nicoledotson.icu

  24. 1 domain, 1 url_path7 yrs ago

    twitter.com/eyalsela/status/927211526406266881

    domainrviedofree.com
    url_path/dad5/

  25. 1 url_path7 yrs ago

    twitter.com/eyalsela/status/883243599705645056

    /sami

  26. 1 domain7 yrs ago

    twitter.com/cyberintproject/status/9509304335959244…

    officeappslive.site

  27. 1 domain7 yrs ago

    docs.google.com/document/d/1oYX3uN6KxIX_StzTH0s0yFNNoHD…

    storgemydata.website

  28. 1 domain7 yrs ago

    unit42.paloaltonetworks.com/pymicropsia

    samwinchester.club

  29. 1 domain8 yrs ago

    twitter.com/ClearskySec/status/965985346222723072

    katesacker.club

  30. 1 domain8 yrs ago

    twitter.com/ClearskySec/status/946364079630897152

    accountforuser.website

  31. 15 domain11 yrs ago

    securelist.com/files/2015/02/The-Desert-Falcons-target…

    abuhmaid.net
    advtravel.info
    androcity.com
    blogging-host.info
    facebook-emoticons.bitblogoo.com
    fpupdate.info
    ineltdriver.com
    iwork-sys.com
    linkedim.in
    linksis.info
    liptona.net
    mediahitech.info
    nauss-lab.com
    nice-mobiles.com
    tvgate.rocks

  32. 6 domain11 yrs ago

    securelist.com/files/2015/02/The-Desert-Falcons-target… · trendmicro.com/cloud-content/us/pdfs/security-intellig…

    ahmedfaiez.info
    flushupate.com
    flushupdate.com
    mixedwork.com
    plmedgroup.com
    pstcmedia.com

  33. 2 domain11 yrs ago

    trendmicro.com/cloud-content/us/pdfs/security-intellig…

    ineltdriver.info
    mediahitech.com

Further reading 40