Loading malware…
GnatSpy is an Android spyware family associated with the cyberespionage actor Arid Viper, also known as APT-C-23 and Desert Falcon. Publicly documented in December 2017, it belongs to the actor’s evolving mobile surveillance toolkit. GnatSpy extends VAMP’s surveillance functionality, including call recording and collection of contacts and documents, with additional collection of battery usage, memory, storage, and SIM-card information. It supports uploading collected information to attacker-controlled infrastructure.
GnatSpy shares code and upload functionality with later Arid Viper Android spyware, including SpyC23, demonstrating continuity across the actor’s mobile tooling. Its operational context is espionage in the Middle East, where Arid Viper has targeted Palestinian and Israeli individuals and organizations, including government and security personnel, journalists, and dissidents.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GnatSpy, which expands VAMP's functionality by collecting information about battery usage, memory, storage, and SIM card status.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The main changes from earlier research centered primarily around code obfuscation being added by those developing this malware.
Retrieve photos from the camera roll ... Retrieve contacts ... Retrieve text messages ... Search for and return the path of files with a doc or PDF extension
The analyzed Arid Viper Android malware contained the following functionality: • Take screenshots or record video
Phenakite periodically recording audio and notifying C2 infrastructure... Similarly, Phenakite periodically uses the camera of a compromised device to take photos
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as malware/infrastructure context tied to a domain previously linked to APT-C-23/AridViper.
Older Arid Viper Android spyware family sharing code and upload functionality overlaps with newer SpyC23 variants; a 2017 sample shared the same upload functionality through a subclass JsDirService.
Android spyware extending VAMP with additional device profiling and status collection capabilities.
GnatSpy is identified as a newly discovered mobile malware family.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.