AridViper__2015__The-Desert-Falcons-targeted-attacks.pdf

**Executive Summary:** Kaspersky Lab documents the 'Desert Falcons' APT — an Arabic-speaking cyber mercenary group active since 2011 (real activity from 2013) that used spearphishing, social-engineering, and custom Windows/Android backdoors (DHS/iRat) to compromise mainly Middle East government, media, military, and activist targets, exfiltrating roughly one million files from over 3,000 victims and operating multiple C2 domains/IPs with published IOCs and timelines.