Stealth Falcon

Stealth Falcon, also tracked here as daffodil_gust and also known as FruityArmor, Fruity Armor, G0038, and Project Raven, is a likely state-sponsored cyberespionage threat actor aligned with UAE interests. Reporting in the provided content describes the group as active since at least 2012 and focused on governments, government-adjacent entities, defense organizations, and dissidents, primarily in the Middle East and surrounding region, including targeting in the UAE, Turkey, Qatar, Egypt, and Yemen. Citizen Lab described Stealth Falcon as a sophisticated and likely state-sponsored group targeting Emirati journalists, activists, and dissidents, with circumstantial evidence aligning its interests with UAE Security Forces. The group has used targeted spyware and spear-phishing operations involving fake Twitter personas, spoofed emails, phony websites, malicious shortened URLs, and macro-enabled documents. In one documented chain, a macro passed a Base64-encoded PowerShell command that gathered system information through WMI and queried the Windows Registry to determine the installed .NET version. Stealth Falcon malware is described as gathering running processes, local system data, and detailed host information via WMI, including system directory, build number, serial number, version, manufacturer, model, and total physical memory. The malware also used PowerShell and WMI for scripted data collection and command execution, communicated with command-and-control over HTTPS, exfiltrated collected data over the existing C2 channel, and established persistence via a scheduled task named "IE Web Cache" executed hourly. Credential theft capabilities described in the content include collection of passwords from Internet Explorer, Firefox, Chrome, Windows Credential Vault, Outlook, and other local sources. The content also describes a 2025 Stealth Falcon campaign against a major Turkish defense company exploiting CVE-2025-33053, a Windows WebDAV zero-day. That operation used a malicious .url file, abused working-directory behavior in legitimate Windows tools to load files from an attacker-controlled WebDAV server, and culminated in deployment of Horus Agent, a custom Mythic implant. Horus Agent is described as an evolution of the group’s customized Apollo implant and uses code virtualization, string encryption, and API hashing for evasion. Additional Stealth Falcon tooling identified in the content includes a domain controller credential dumper that accesses virtual disk copies to bypass file locks, a passive backdoor that listens for shellcode execution requests, and an RC4-encrypted keylogger. The group is also noted for using repurposed legitimate domains, often .net or .com domains purchased through NameCheap, as part of its infrastructure. The provided content further notes that Citizen Lab first encountered NSO infrastructure while investigating Stealth Falcon, and that Pegasus infrastructure overlapped with infrastructure previously fingerprinted as part of Stealth Falcon activity. However, the content distinguishes NSO Group and Pegasus from Stealth Falcon rather than treating them as aliases.