Sphinx
Sphinx is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in Israel and Egypt.
- APT-C-15
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2014
- Record updated
Who They Target.
About Sphinx.
Operation Sphinx is a cyber-espionage activity in the Middle East. The main victims are political and military organizations in Egypt, Israel and possibly other countries. Sensitive data theft is what the attackers plotted for during the period from June, 2014 to November, 2015 when the activity was in its prime. We encountered some timestamps of the samples to be as early as December, 2011 which suggests the attack might be started much earlier, though further sound proof is needed. The main approach of Sphinx is watering hole attack on social web sites. Until now, we have obtained 314 pieces of sample malicious codes and 7 C2 domains.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.