Loading malware…
GnatSpy is an Android spyware family associated with Arid Viper, also tracked as APT-C-23 and Desert Falcon, a long-running Middle East-focused cyber-espionage actor. Public reporting places GnatSpy among the group’s mobile surveillance toolsets alongside VAMP, FrozenCell, DesertScorpion, ViperRAT, and later SpyC23 variants. The malware has been linked to campaigns targeting Arabic-speaking victims and regional political or military interests, including Palestinian and Israeli targets in different Arid Viper operations.
GnatSpy is described as extending functionality seen in VAMP. Reported capabilities include collection of device state and telemetry such as battery usage, memory, storage, and SIM card status. Code and functionality overlaps between later Arid Viper Android spyware and older families, including GnatSpy, indicate that components or design patterns from GnatSpy informed subsequent implants used by the actor. Shared upload logic and other implementation similarities have been noted between later SpyC23 samples and earlier GnatSpy code.
The family fits Arid Viper’s broader pattern of mobile espionage operations that rely heavily on social engineering and trojanized Android applications. Across the actor’s Android campaigns, lures have included messaging, dating, and topical regional themes, with malware commonly distributed through weaponized apps outside official app stores. GnatSpy should therefore be understood as part of an evolving Android surveillance ecosystem used for intelligence collection against targets of interest in the Middle East.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Notably, the domain name 'escanor[.]live' has been previously identified in connection to AridViper (APT-C-23 / GnatSpy) infrastructure.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The main changes from earlier research centered primarily around code obfuscation being added by those developing this malware.
Retrieve photos from the camera roll ... Retrieve contacts ... Retrieve text messages ... Search for and return the path of files with a doc or PDF extension
The analyzed Arid Viper Android malware contained the following functionality: • Take screenshots or record video
Phenakite periodically recording audio and notifying C2 infrastructure... Similarly, Phenakite periodically uses the camera of a compromised device to take photos
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as malware/infrastructure context tied to a domain previously linked to APT-C-23/AridViper.
Older Arid Viper Android spyware family sharing code and upload functionality overlaps with newer SpyC23 variants; a 2017 sample shared the same upload functionality through a subclass JsDirService.
Android spyware extending VAMP with additional device profiling and status collection capabilities.
GnatSpy is identified as a newly discovered mobile malware family.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.