GnatSpy
GnatSpy is an Android malware family associated with Arid Viper, also known as Desert Falcon and APT-C-23. Public reporting describes it as part of the group’s evolving mobile surveillance tooling and as one of several malware families attributed to the actor over time, alongside VAMP, FrozenCell, DesertScorpion, ViperRAT, SpyC23, and Phenakite. The malware is described as extending the functionality of VAMP by collecting additional device information, specifically battery usage, memory, storage, and SIM card status. Supporting reporting places GnatSpy within Arid Viper’s broader cyber-espionage activity targeting primarily Palestinian individuals and organizations, with other reporting across the same actor cluster also documenting targeting of Israeli and Palestinian victims, including government, security, political, and student-related targets. High-confidence content directly provided here does not include specific GnatSpy infection-chain details or standalone indicators of compromise for this family.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The ever-changing malware family attributed to APT-C-23 over the years includes VAMP, GnatSpy, FrozenCell, DesertScorpion, and ViperRAT.
Techniques & procedures
14 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueThis spike in account creation towards the later half of 2019 was observed alongside an increase in attempts to distribute both iOS and Android malware as well as phish credentials from users.
Execution
2 techniquesIn all cases the successful installation of these tools did not require any exploits. This suggests that Arid Viper operators continue to heavily rely on social engineering to distribute their malware.
Android malware was typically hosted on convincing looking attacker-controlled phishing sites.
Stealth
3 techniquesThe main changes from earlier research centered primarily around code obfuscation being added by those developing this malware.
Facebook found recent variants pretending to be popular Android applications for dating, networking, and regional banking in the Middle East.
the values for those C2 domains first contacted weren’t hardcoded in the Java layer, where they would be clearly visible, instead they were encrypted and stored in a separate ELF binary.
Collection
5 techniquesRetrieve photos from the camera roll ... Retrieve contacts ... Retrieve text messages ... Search for and return the path of files with a doc or PDF extension
The analyzed Arid Viper Android malware contained the following functionality: • Take screenshots or record video
Phenakite periodically recording audio and notifying C2 infrastructure... Similarly, Phenakite periodically uses the camera of a compromised device to take photos
Phenakite periodically uses the camera of a compromised device to take photos and sends these automatically to attacker infrastructure.
Search for files of specific types and add them to RAR archives for exfiltration
Command and Control
2 techniquesUse Base64 to obfuscate command and control communications
Some Primewire samples utilize “multipart/form-data” for command and control check-ins... other samples combine the C2 parameters into a single “application/x-www-form-urlencoded” POST body.
Exfiltration
1 techniqueuploading any files present before recursively uploading any files in subdirectories.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android spyware extending VAMP with additional device profiling and status collection capabilities.
GnatSpy is identified as a newly discovered mobile malware family.
Named Android surveillanceware/tooling family attributed over time to APT-C-23/Arid Viper.
Named Android surveillanceware/tooling family attributed over time to APT-C-23/Arid Viper.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.