Evolving Cyber Threats: Arid Viper’s Expanding Malware Arsenal Against the Middle East

The threat actor known as Arid Viper has been observed engaging in a fresh wave of targeted attacks on Palestinian entities since September 2022. In response, Symantec, a cybersecurity company, has been tracking the group, now referred to by their pest-themed moniker, Mantis. According to their latest findings, the group is going to great lengths to maintain a persistent presence on the targeted networks.

Arid Viper’s Techniques for Maintaining a Persistent Presence

Mantis appears to be a determined adversary, as evidenced by their use of various techniques to maintain a persistent presence on the targeted networks. One such technique is to use homemade malware tools, which they regularly update and mutate to evade detection. In their latest attacks, Mantis has refreshed their well-known toolkit and is using it to carry out numerous cyber espionage campaigns aimed at gaining access to data from Palestinian entities.”

Arid Viper’s History of Attacks in Palestine and the Middle East

Arid Viper has been linked to previous cyber-espionage campaigns aimed at Palestine and the Middle East since 2014. The group has been known to use malware, spear-phishing, and social engineering tactics to breach targets and steal sensitive data. It is worth noting that, in the past, Arid Viper has also been linked to the cyber warfare division of Hamas.

Mantis’ Use of Homemade Malware Tools

Mantis has always been known for its homemade malware toolkit. The group creates and uses a variety of custom malware tools such as ViperRat, FrozenCell, and Micropsia to execute and conceal its campaigns on various platforms, including Windows, Android, and iOS. The group also uses these tools to launch spear-phishing campaigns and securely exfiltrate any stolen data.

Alleged Ties to the Cyber Warfare Division of Hamas

An earlier report suggests that Mantis may have links to the cyber warfare division of Hamas, a Palestinian militant group that controls Gaza. Although there is not much evidence of a formal working relationship between the two groups, analysts believe that they share similar objectives, namely to target Israeli businesses and the military.

Methods Employed in Attack Sequences

In their recent attacks, Mantis has been using spear-phishing emails, fake social credentials, and malware to lure their targets into installing malware on their devices. Once successful, attackers proceed to maintain a persistent presence by using malware tools such as Micropsia and Arid Gopher to steal login credentials quietly, allowing them to access and exfiltrate sensitive data.

Detailed information about recent attacks using updated versions of Micropsia and Arid Gopher implants

According to Symantec, the most recent attacks by Mantis involve refreshed versions of custom implants Micropsia and Arid Gopher to breach their targets. The attackers have aggressively updated the code of these tools while deploying updated versions on multiple workstations, providing them access to more data.

Evidence of Deploying Multiple Versions of the Malware to Retain Access

Symantec researchers gathered evidence that suggests Mantis moved to deploy three distinct versions of Micropsia and Arid Gopher on three sets of workstations between December 18, 2022, and January 12, 2023. The group used this method as a way of retaining access, taking note of possible outages on specific workstations to redeploy other versions of the malware.

Arid Gopher Receiving Regular Updates with Aggressive Mutation Tactics

As an antivirus company, our researchers have found that Arid Gopher is one of the most sophisticated tools in Mantis’ malware toolkit. It receives regular updates and complete rewrites of code, with the malware authors “aggressively mutating the logic between variants” to evade detection even further.

The conclusion highlights Mantis’ determination and dedication in maximizing their chances of success through recent attacks. They have demonstrated their commitment to using updated versions of their customized malware toolkit and deploying multiple updated versions of the same malware. As Mantis has a propensity for custom-made malware, Symantec recommends that Palestinian entities remain vigilant and take adaptive defensive measures to reduce the likelihood of falling victim to Mantis attacks.

Explore more

Onsite Meetings Drive Success with Business Central

In an era where digital communication tools dominate the business landscape, the enduring value of face-to-face interaction often gets overlooked, yet it remains a powerful catalyst for effective technology implementation. Imagine a scenario where a company struggles to integrate a complex system like Microsoft Dynamics 365 Business Central, grappling with inefficiencies that virtual meetings fail to uncover. Onsite visits, where

Balancing AI and Human Touch in Modern Staffing Practices

Imagine a hiring process where algorithms sift through thousands of resumes in seconds, matching candidates to roles with uncanny precision, yet when it comes time to seal the deal, a candidate hesitates—not because of the job, but because they’ve never felt a genuine connection with the recruiter. This scenario underscores a critical tension in today’s staffing landscape: technology can streamline

AI’s Transformative Power in Wealth Management Unveiled

I’m thrilled to sit down with a true visionary in the wealth management space, whose extensive experience and forward-thinking approach have made them a leading voice on the integration of technology in finance. With a deep understanding of how artificial intelligence is reshaping the industry, they’ve guided numerous firms through the evolving landscape of client services and operational efficiency. Today,

Navigating WealthTech Risks and Trends for 2025 with Braiden

Allow me to introduce Nicholas Braiden, a pioneering figure in the FinTech space and an early adopter of blockchain technology. With a deep-rooted belief in the power of financial technology to revolutionize digital payments and lending, Nicholas has spent years advising startups on harnessing tech to fuel innovation. Today, we dive into his insights on navigating the complex landscape of

Trend Analysis: 5G Giga Sites Revolutionizing Connectivity

Imagine a bustling urban center where thousands of people stream high-definition content, engage in real-time gaming, and conduct critical business operations simultaneously, all without a glitch in connectivity. This vision is becoming reality with the advent of 5G Giga Sites, a transformative force in mobile networks that promises to redefine how society interacts with data. As digital demands soar with