Skip to content
brandefense.io
Request A Demo
Nation-state APTIdeologyAdvanced sophistication · State-backed

Stealth Falcon

Stealth Falcon is a nation-state APT group with an ideological motive, tracked by Brandefense. It targets 7 sectors, including Government and Manufacturing, in 16 countries, including the United States and the United Kingdom. It uses 32 MITRE ATT&CK techniques and exploits 10 known CVEs.

Also known as
  • FruityArmor
  • Project Raven
  • G0038
Request IOC feedRequest ATT&CK export
Techniques
32
Exploited CVEs
10
First seen
Jan 1, 2012
Last seen
May 29, 2016
Record updated

Who They Target.

Sectors · 7
Countries · 16
Labelsespionageglobal

How They Operate · MITRE ATT&CK.

32 techniques across 10 of 14 tactics

Reconnaissance6

T1012
Query Registry
T1033
System Owner/User Discovery
T1057
Process Discovery
T1071.001
Application Layer Protocol: Web Protocols
T1082
System Information Discovery
T1583.001
Acquire Infrastructure: Domains

Resource Development1

T1587.001
Develop Capabilities: Malware

Initial Access2

T1204.002
User Execution: Malicious File
T1566
Phishing

Execution9

T1047
Windows Management Instrumentation
T1053.005
Scheduled Task/Job: Scheduled Task
T1055
Process Injection
T1059
Command and Scripting Interpreter
T1059.001
Command and Scripting Interpreter: PowerShell
T1059.003
Command and Scripting Interpreter: Windows Command Shell
T1140
Deobfuscate/Decode Files or Information
T1218.011
System Binary Proxy Execution: Rundll32
T1620
Reflective Code Loading

Persistence2

T1112
Modify Registry
T1546.003
Event Triggered Execution: Windows Management Instrumentation Event Subscription

Privilege Escalation·

Defense Evasion5

T1027
Obfuscated Files or Information
T1036.005
Masquerading: Match Legitimate Resource Name or Location
T1070.004
Indicator Removal: File Deletion
T1480.001
Execution Guardrails: Environmental Keying
T1573.001
Encrypted Channel: Symmetric Cryptography

Credential Access3

T1555
Credentials from Password Stores
T1555.003
Credentials from Password Stores: Credentials from Web Browsers
T1555.004
Credentials from Password Stores: Windows Credential Manager

Discovery2

T1007
System Service Discovery
T1016
System Network Configuration Discovery

Lateral Movement·

Collection1

T1005
Data from Local System

Command and Control·

Exfiltration1

T1041
Exfiltration Over C2 Channel

Impact·

Vulnerabilities They Exploit.

Browse Vulnerability Intelligence →
CVE-2021-21166Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.ExploitedhighCVE-2021-30551Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.ExploitedhighCVE-2025-33053Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the…ExploitedhighCVE-2025-33073Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation.ExploitedhighCVE-2018-8453Microsoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.ExploitedhighCVE-2018-8611A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.ExploitedhighCVE-2019-0797Microsoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory.ExploitedhighCVE-2021-31979Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.ExploitedhighCVE-2021-33771Microsoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.ExploitedhighCVE-2021-33742Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.Exploitedhigh

Arsenal · Malware And Tools.

  • Deadglyphmalware
  • DevilsTonguemalware
  • Arptool
  • PowerShelltool

Showing 4 of 5 malware families and tools. 1 more is in restricted Brandefense intelligence. Request a demo

Indicators Of Compromise.

TLP:AMBER

26 indicators on the Brandefense platform

IP, domain and hash indicators · YARA rules · ATT&CK Navigator export

Request A Demo

About Stealth Falcon.

An APT group known for exploiting zero-day vulnerabilities. In March 2025, they exploited a WebDAV zero-day (CVE-) to target a defense company in Turkey.

Last updated Sep 21, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.