Evolving Cyber Threats: Arid Viper’s Expanding Malware Arsenal Against the Middle East

The threat actor known as Arid Viper has been observed engaging in a fresh wave of targeted attacks on Palestinian entities since September 2022. In response, Symantec, a cybersecurity company, has been tracking the group, now referred to by their pest-themed moniker, Mantis. According to their latest findings, the group is going to great lengths to maintain a persistent presence on the targeted networks.

Arid Viper’s Techniques for Maintaining a Persistent Presence

Mantis appears to be a determined adversary, as evidenced by their use of various techniques to maintain a persistent presence on the targeted networks. One such technique is to use homemade malware tools, which they regularly update and mutate to evade detection. In their latest attacks, Mantis has refreshed their well-known toolkit and is using it to carry out numerous cyber espionage campaigns aimed at gaining access to data from Palestinian entities.”

Arid Viper’s History of Attacks in Palestine and the Middle East

Arid Viper has been linked to previous cyber-espionage campaigns aimed at Palestine and the Middle East since 2014. The group has been known to use malware, spear-phishing, and social engineering tactics to breach targets and steal sensitive data. It is worth noting that, in the past, Arid Viper has also been linked to the cyber warfare division of Hamas.

Mantis’ Use of Homemade Malware Tools

Mantis has always been known for its homemade malware toolkit. The group creates and uses a variety of custom malware tools such as ViperRat, FrozenCell, and Micropsia to execute and conceal its campaigns on various platforms, including Windows, Android, and iOS. The group also uses these tools to launch spear-phishing campaigns and securely exfiltrate any stolen data.

Alleged Ties to the Cyber Warfare Division of Hamas

An earlier report suggests that Mantis may have links to the cyber warfare division of Hamas, a Palestinian militant group that controls Gaza. Although there is not much evidence of a formal working relationship between the two groups, analysts believe that they share similar objectives, namely to target Israeli businesses and the military.

Methods Employed in Attack Sequences

In their recent attacks, Mantis has been using spear-phishing emails, fake social credentials, and malware to lure their targets into installing malware on their devices. Once successful, attackers proceed to maintain a persistent presence by using malware tools such as Micropsia and Arid Gopher to steal login credentials quietly, allowing them to access and exfiltrate sensitive data.

Detailed information about recent attacks using updated versions of Micropsia and Arid Gopher implants

According to Symantec, the most recent attacks by Mantis involve refreshed versions of custom implants Micropsia and Arid Gopher to breach their targets. The attackers have aggressively updated the code of these tools while deploying updated versions on multiple workstations, providing them access to more data.

Evidence of Deploying Multiple Versions of the Malware to Retain Access

Symantec researchers gathered evidence that suggests Mantis moved to deploy three distinct versions of Micropsia and Arid Gopher on three sets of workstations between December 18, 2022, and January 12, 2023. The group used this method as a way of retaining access, taking note of possible outages on specific workstations to redeploy other versions of the malware.

Arid Gopher Receiving Regular Updates with Aggressive Mutation Tactics

As an antivirus company, our researchers have found that Arid Gopher is one of the most sophisticated tools in Mantis’ malware toolkit. It receives regular updates and complete rewrites of code, with the malware authors “aggressively mutating the logic between variants” to evade detection even further.

The conclusion highlights Mantis’ determination and dedication in maximizing their chances of success through recent attacks. They have demonstrated their commitment to using updated versions of their customized malware toolkit and deploying multiple updated versions of the same malware. As Mantis has a propensity for custom-made malware, Symantec recommends that Palestinian entities remain vigilant and take adaptive defensive measures to reduce the likelihood of falling victim to Mantis attacks.

Explore more

How Are Cybercriminals Targeting OpenAI and Sora Users?

Introduction to Phishing Threats in AI Platforms In an era where artificial intelligence tools like OpenAI and Sora are integral to both personal and corporate workflows, a startling wave of sophisticated phishing campaigns has emerged to exploit unsuspecting users, posing a significant risk to data security and privacy. These attacks, characterized by deceptive emails and counterfeit login portals, are designed

How Are FBI Spoofing Scams Targeting Facebook Users?

In an era where digital trust is constantly tested, a disturbing trend has emerged that exploits the credibility of a respected institution, with scammers impersonating the FBI’s Internet Crime Complaint Center (IC3) through sophisticated spoofing schemes on social media platforms like Facebook. These scams lure unsuspecting users into traps designed to steal personal information, undermining public safety and highlighting the

Red Lion RTU Vulnerabilities – Review

Imagine a critical energy grid or water treatment facility grinding to a halt due to a cyberattack that exploits a tiny flaw in a widely used control device, a scenario that is not far-fetched given the recent discovery of severe vulnerabilities in Red Lion Sixnet remote terminal units (RTUs), which are essential components in industrial automation. These devices, pivotal in

AI Cybersecurity Threats – Review

The rapid adoption of artificial intelligence (AI) across industries has transformed operational landscapes, promising unprecedented efficiency and innovation. Yet, beneath this technological marvel lies a staggering reality: half of all organizations have encountered detrimental impacts from security flaws in their AI systems, underscoring a critical challenge in the digital era where AI serves as both a powerful ally and a

Is the U.S. Behind a Cyber Attack on China’s Time System?

As we dive into the complex world of cybersecurity and international tensions, I’m thrilled to sit down with Dominic Jainy, an IT professional with deep expertise in artificial intelligence, machine learning, and blockchain. With a keen interest in how emerging technologies shape industries and national security, Dominic offers a unique perspective on the recent allegations made by China’s Ministry of