APT-C-44
APT-C-44 is an Algeria-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Defense and Aerospace sector. It uses 9 MITRE ATT&CK techniques.
Also known as
- North Africa Fox
- Origin
- Algeria
- Techniques
- 9
- Exploited CVEs
- No CVE data
- First seen
- Oct 23, 2020
- Last seen
- Oct 23, 2020
- Record updated
Who They Target.
Sectors · 1
How They Operate · MITRE ATT&CK.
9 techniques across 8 of 14 tacticsReconnaissance·
Resource Development·
Initial Access1
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
Execution1
T1059.005
Command and Scripting Interpreter: Visual Basic
Command and Scripting Interpreter: Visual Basic
Persistence1
T1136
Create Account
Create Account
Privilege Escalation·
Defense Evasion2
T1036.005
Masquerading: Match Legitimate Resource Name or Location
Masquerading: Match Legitimate Resource Name or Location
T1564
Hide Artifacts
Hide Artifacts
Credential Access1
T1056.001
Input Capture: Keylogging
Input Capture: Keylogging
Discovery·
Lateral Movement·
Collection1
T1123
Audio Capture
Audio Capture
Command and Control1
T1568.002
Dynamic Resolution: Domain Generation Algorithms
Dynamic Resolution: Domain Generation Algorithms
Exfiltration1
T1567
Exfiltration Over Web Service
Exfiltration Over Web Service
Impact·
Arsenal · Malware And Tools.
- DroidJackmalware
- Hallaj Pro RATmalware
- SonicSpymalware
- SpyNotemalware
- Xtreme RATmalware
Campaigns.
- APT-C-44 Middle East & North Africa Espionage CampaignOct 2020
Indicators Of Compromise.
TLP:AMBER42 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout APT-C-44.
An advanced persistent threat group originating from Algeria, active since at least October 2017, targeting Arabic-speaking individuals and military-associated entities with dual Windows and Android malware.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.