Arid Viper

THREAT ACTOR PROFILE

Arid Viper

Arid Viper is a Middle Eastern espionage group active since around 2013, tracked as APT-C-23, with interests aligned to Hamas. It specializes in mobile surveillance, luring targets in Israel, Palestine and Egypt into installing trojanized Android apps, including fake messaging and civil-defense apps, to steal messages, contacts and location data.

Palestine (Hamas-aligned)

Government / Defense

First seen

2013

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Arid Viper, Desert Falcon and Bearded Barbie

Arid Viper carries several vendor names for the same Middle Eastern activity. They map to one entry among the mobile-focused and other tracked actors, so a Desert Falcon report and an APT-C-23 advisory read as one group. It operates in the same theater as Handala.

GROUP PROFILE

Mobile surveillance across the Levant

Arid Viper collects intelligence aligned with Hamas interests, targeting military, government and individual targets in Israel, along with Palestinian and Egyptian users. Mobile espionage is its defining capability.

Our record places its origin as Palestine and ties it to espionage across government and defense. It has a long history of social-engineering lures, including romance-themed and app-update ruses.

The group's core capability is the SpyC23 Android spyware family and its successors (AridSpy), delivered through fake apps that mimic messaging tools, dating apps, and even a trojanized version of Israel's Red Alert rocket-warning app that keeps full legitimate functionality while exfiltrating data.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Fake apps into Android spyware

The stages below come from Arid Viper activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

SpyC23, AridSpy and fake apps

Initial Access

CVES EXPLOITED

Arid Viper

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Arid Viper

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Arid Viper

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

Red Alert impersonation and AridSpy

Recent reporting tracks Arid Viper's mobile spyware campaigns.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.