Home / Threat actors / Stealth Falcon
Stealth Falcon G0038
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
18
Techniques
0
Malware and tools
Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShell Persistence
T1053.005 Scheduled Task Privilege Escalation
T1053.005 Scheduled Task Credential Access
T1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1555.004 Windows Credential Manager Discovery
T1012 Query RegistryT1016 System Network Configuration DiscoveryT1033 System Owner/User DiscoveryT1057 Process DiscoveryT1082 System Information Discovery Collection
T1005 Data from Local System Command and Control
T1071.001 Web ProtocolsT1573.001 Symmetric Cryptography Exfiltration
T1041 Exfiltration Over C2 Channel © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.