The threat actor known as Arid Viper has been observed engaging in a fresh wave of targeted attacks on Palestinian entities since September 2022. In response, Symantec, a cybersecurity company, has been tracking the group, now referred to by their pest-themed moniker, Mantis. According to their latest findings, the group is going to great lengths to maintain a persistent presence on the targeted networks.
Arid Viper’s Techniques for Maintaining a Persistent Presence
Mantis appears to be a determined adversary, as evidenced by their use of various techniques to maintain a persistent presence on the targeted networks. One such technique is to use homemade malware tools, which they regularly update and mutate to evade detection. In their latest attacks, Mantis has refreshed their well-known toolkit and is using it to carry out numerous cyber espionage campaigns aimed at gaining access to data from Palestinian entities.”
Arid Viper’s History of Attacks in Palestine and the Middle East
Arid Viper has been linked to previous cyber-espionage campaigns aimed at Palestine and the Middle East since 2014. The group has been known to use malware, spear-phishing, and social engineering tactics to breach targets and steal sensitive data. It is worth noting that, in the past, Arid Viper has also been linked to the cyber warfare division of Hamas.
Mantis’ Use of Homemade Malware Tools
Mantis has always been known for its homemade malware toolkit. The group creates and uses a variety of custom malware tools such as ViperRat, FrozenCell, and Micropsia to execute and conceal its campaigns on various platforms, including Windows, Android, and iOS. The group also uses these tools to launch spear-phishing campaigns and securely exfiltrate any stolen data.
Alleged Ties to the Cyber Warfare Division of Hamas
An earlier report suggests that Mantis may have links to the cyber warfare division of Hamas, a Palestinian militant group that controls Gaza. Although there is not much evidence of a formal working relationship between the two groups, analysts believe that they share similar objectives, namely to target Israeli businesses and the military.
Methods Employed in Attack Sequences
In their recent attacks, Mantis has been using spear-phishing emails, fake social credentials, and malware to lure their targets into installing malware on their devices. Once successful, attackers proceed to maintain a persistent presence by using malware tools such as Micropsia and Arid Gopher to steal login credentials quietly, allowing them to access and exfiltrate sensitive data.
Detailed information about recent attacks using updated versions of Micropsia and Arid Gopher implants
According to Symantec, the most recent attacks by Mantis involve refreshed versions of custom implants Micropsia and Arid Gopher to breach their targets. The attackers have aggressively updated the code of these tools while deploying updated versions on multiple workstations, providing them access to more data.
Evidence of Deploying Multiple Versions of the Malware to Retain Access
Symantec researchers gathered evidence that suggests Mantis moved to deploy three distinct versions of Micropsia and Arid Gopher on three sets of workstations between December 18, 2022, and January 12, 2023. The group used this method as a way of retaining access, taking note of possible outages on specific workstations to redeploy other versions of the malware.
Arid Gopher Receiving Regular Updates with Aggressive Mutation Tactics
As an antivirus company, our researchers have found that Arid Gopher is one of the most sophisticated tools in Mantis’ malware toolkit. It receives regular updates and complete rewrites of code, with the malware authors “aggressively mutating the logic between variants” to evade detection even further.
The conclusion highlights Mantis’ determination and dedication in maximizing their chances of success through recent attacks. They have demonstrated their commitment to using updated versions of their customized malware toolkit and deploying multiple updated versions of the same malware. As Mantis has a propensity for custom-made malware, Symantec recommends that Palestinian entities remain vigilant and take adaptive defensive measures to reduce the likelihood of falling victim to Mantis attacks.
