Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Stealth Falcon · Nation-state · assessed origin United Arab Emirates · misp-galaxy + mitre-attack · refreshed 2026-10-06

Stealth Falcon

  • FruityArmor
  • G0038

state sponsor · United Arab EmiratesMITRE G0038 ↗

Stealth Falcon — ATT&CK roseSF

attack rose · 16 techniques across 6 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2025-33053

Analyst brief

misp-galaxy + mitre-attack

This threat actor targets civil society groups and Emirati journalists, activists, and dissidents.

Observed targets (as stated by the sources)

2 countries · 4 sectors
United Arab EmiratesUnited KingdomAssessed origin: United Arab Emirates

assessed origin · United Arab Emiratesobserved targets · 2

countries · 2

  • United Arab Emirates
  • United Kingdom

sectors · 4

  • Civil society
  • Activists
  • Dissidents
  • Journalist

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

16 techniques · 6 of 15 tactics

  1. Execution

    4 techniques

  2. Credential access

    3 techniques

  3. Discovery

    5 techniques

  4. Collection

    1 technique

  5. Command and control

    2 techniques

  6. Exfiltration

    1 technique

select a technique

CVEs reports attribute to Stealth Falcon

none on KEV
  1. CVE-2025-330532026-10-17
    1. “The most developed test set focused on CVE-2025-33053, the working-directory abuse technique reported by Check Point in its analysis of Stealth Falcon activity.”

      attributed by a report · source: rapid7.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2016Stealth FalconCitizen Lab ↗

Take it with you

keyless · no signup

References

6 sources
  1. 1.citizenlab.ca/2016/05/stealth-falcon
  2. 2.cfr.org/interactive/cyber-operations/stealth-falcon
  3. 3.securelist.com/cve-2019-0797-zero-day-vulnerability/89885
  4. 4.attack.mitre.org/groups/G0038
  5. 5.attack.mitre.org/groups/G0038
  6. 6.citizenlab.org/2016/05/stealth-falcon

Track Stealth Falcon on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.