FORENSIA

THREAT_ACTOR · G0038

Stealth Falcon

Also known as: Stealth Falcon

Profile

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.

MITRE ATT&CK ↗

Techniques

16 ATT&CK techniques attributed to this actor.

T1005 Data from Local SystemT1012 Query RegistryT1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1041 Exfiltration Over C2 ChannelT1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1057 Process DiscoveryT1059 Command and Scripting InterpreterT1059.001 PowerShellT1071.001 Web ProtocolsT1082 System Information DiscoveryT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1555.004 Windows Credential ManagerT1573.001 Symmetric Cryptography

Related corpus activity

10,029 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Stealth Falcon.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2022-47945cve—851
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2025-23304cve—852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2026-4368cveransomware851
cve-2016-5681cve—852
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,029.