Desert Falcons
Desert Falcons is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets 7 sectors, including Government and Manufacturing, in 4 countries, including Israel and Egypt. It uses 10 MITRE ATT&CK techniques.
Also known as
- FalconsAPT
- Techniques
- 10
- Exploited CVEs
- No CVE data
- First seen
- Feb 17, 2015
- Last seen
- Feb 17, 2015
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
10 techniques across 5 of 15 tacticsReconnaissance1
T1071.001
Application Layer Protocol: Web Protocols
Application Layer Protocol: Web Protocols
Resource Development·
Initial Access3
T1204.002
User Execution: Malicious File
User Execution: Malicious File
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
Execution·
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access2
T1056.001
Input Capture: Keylogging
Input Capture: Keylogging
T1555.003
Credentials from Password Stores: Credentials from Web Browsers
Credentials from Password Stores: Credentials from Web Browsers
Discovery·
Lateral Movement·
Command and Control·
Exfiltration·
Impact·
Stealth1
T1036.009
Masquerading: Break Process Trees
Masquerading: Break Process Trees
Arsenal · Malware And Tools.
- DHS Spywaremalware
- Falcons Trojanmalware
- iRatmalware
- WinRARtool
Campaigns.
- Desert Falcons Targeted AttacksFeb 2015
Indicators Of Compromise.
TLP:AMBER102 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Desert Falcons.
A native Arabic-speaking cyber espionage and mercenary group consisting of approximately 30 members operating across three teams based in Palestine, Egypt, and Turkey, active since at least 2011.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.