MalwareUsed by 1 actor

FrozenCell

FrozenCell is an Android spyware family associated with the Palestinian threat actor Arid Viper, also tracked as APT-C-23 or Desert Falcon. It has been used in targeted mobile espionage operations, including campaigns against Palestinian government officials and other regional targets. Reporting on later Arid Viper Android tooling identifies substantial similarities between FrozenCell and related families such as VAMP, GnatSpy, and newer SpyC23 variants, indicating an evolving cluster of closely related surveillance implants.

FrozenCell is designed for covert collection and exfiltration of victim data from compromised Android devices. Documented capabilities include reading SMS messages, retrieving images stored on the device, and gathering device profiling information such as manufacturer, model, serial number, and mobile network metadata including cell location and carrier codes. These functions support both victim surveillance and operator-side targeting decisions.

Distribution has relied on social engineering through trojanized Android applications masquerading as legitimate or expected software. Observed lures included fake updates for popular chat and messaging applications such as Facebook, WhatsApp, Messenger, LINE, and LoveChat, as well as applications tailored to Middle Eastern audiences. This impersonation-based delivery aligns with Arid Viper’s broader practice of using convincing themed apps and third-party installation flows rather than sophisticated exploitation chains.

FrozenCell fits the pattern of mobile surveillance malware used for regional cyber-espionage, emphasizing data theft, device profiling, and stealthy presentation through fake application branding. Its role within the Arid Viper ecosystem makes it notable as part of a long-running Android espionage toolset focused on targets in the Middle East.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Arid Viper

The Android tooling used by Arid Viper shares many similarities with malware previously reported as FrozenCell and VAMP.

via facebook securityabout.fb.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence1

This spike in account creation towards the later half of 2019 was observed alongside an increase in attempts to distribute both iOS and Android malware as well as phish credentials from users.

Execution

2 techniques

T1204User ExecutionEvidence1

In all cases the successful installation of these tools did not require any exploits. This suggests that Arid Viper operators continue to heavily rely on social engineering to distribute their malware.

T1204.002Malicious FileEvidence2

That campaign featured several apps designed to mimic Telegram and Android application update managers.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The main changes from earlier research centered primarily around code obfuscation being added by those developing this malware.

T1036MasqueradingEvidence2

Agent Smith can impersonate any popular application on an infected device, and the core malware disguises itself as a legitimate Google application.

T1564.001Hidden Files and DirectoriesEvidence1

the values for those C2 domains first contacted weren’t hardcoded in the Java layer, where they would be clearly visible, instead they were encrypted and stored in a separate ELF binary.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

AbstractEmu can collect device IP address and SIM information; Android/SpyAgent has collected device network information, such as the IMEI and the phone number; ANDROIDOS_ANSERVER.A gathers the device IMEI and IMSI; many listed mobile malware families collect IMEI, IMSI, ICCID, MEID, serial number, phone number, MAC address, IP address, carrier, MCC/MNC, and related device/network identifiers.

Collection

5 techniques

T1005Data from Local SystemEvidence4

Anubis can exfiltrate files encrypted with the ransomware module from the device and can modify external storage. BusyGasper can collect images stored on the device and browser history. CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.

T1113Screen CaptureEvidence1

The analyzed Arid Viper Android malware contained the following functionality: • Take screenshots or record video

T1123Audio CaptureEvidence1

Phenakite periodically recording audio and notifying C2 infrastructure... Similarly, Phenakite periodically uses the camera of a compromised device to take photos

T1125Video CaptureEvidence1

Phenakite periodically uses the camera of a compromised device to take photos and sends these automatically to attacker infrastructure.

T1560Archive Collected DataEvidence1

Search for files of specific types and add them to RAR archives for exfiltration

Command and Control

2 techniques

T1001Data ObfuscationEvidence1

Use Base64 to obfuscate command and control communications

T1071Application Layer ProtocolEvidence1

Some Primewire samples utilize “multipart/form-data” for command and control check-ins... other samples combine the C2 parameters into a single “application/x-www-form-urlencoded” POST body.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence4

FinFisher captures and exfiltrates SMS messages. FrozenCell has read SMS messages for exfiltration. Pallas captures and exfiltrates all SMS messages... Rotexy can also send a list of all SMS messages on the device to the command and control server. RuMMS uploads incoming SMS messages to a remote command and control server. Stealth Mango uploads SMS messages. Windshift has included SMS message exfiltration...

INDICATORS OF COMPROMISE

IOCs tracked for this family

38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

33 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app—

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

lookout blogNews

Jan 1, 2026

JadeRAT Mobile Surveillanceware Spikes in Espionage Activity | Threat Intel

Mobile surveillanceware family mentioned as another example of targeted mobile spying activity.

sentinelone labsNews

Apr 11, 2025

Arid Viper | APT’s Nest of SpyC23 Malware Continues to Target Android Devices | SentinelOne

Older Arid Viper Android spyware family whose audio recording code and status logging strings overlap with newer SpyC23 samples.

mitre attack websiteNews

Oct 21, 2021

Data from Local System, Technique T1533 - Mobile | MITRE ATT&CK®

Android spyware that retrieves device images for exfiltration.

mitre attack websiteNews

Oct 21, 2021

Masquerade as Legitimate Application, Technique T1444 - Mobile | MITRE ATT&CK®

Android trojan that poses as fake updates for chat apps and regionally themed apps targeting Middle Eastern users.

+12 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching38

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

FrozenCell