Operation Arid Viper: Bypassing the Iron Dome

Trend Micro researchers describe 'Operation Arid Viper' and the related 'Advtravel' campaign: targeted spear-phishing deliveries (RAR→SCR→EXE) used pornographic decoys to distract victims while backdoors/stealers registered unique system IDs and exfiltrated documents and mobile data to C2 servers hosted in Germany; the report enumerates C2 domains, IPs, HTTP paths, sample hashes, victim artifacts and control-panel logs, and presents attribution evidence tying infrastructure registrations and developer handles (e.g., Dev_hima, Khalid Samra, Mahmoud Hashem) to actors in Gaza/Egypt.