Technical threat report: Arid Viper

Facebook published a technical analysis of the Arid Viper APT activity describing multi-platform surveillance campaigns targeting individuals and organizations in Palestine. The report details a newly observed iOS implant called 'Phenakite' (distributed via configuration profiles and bundled with public jailbreak/exploit code), evolving Android surveillanceware, continued Micropsia Windows malware variants, delivery via social engineering and phishing, and provides a large set of IOCs (domains, Firebase instances, and file hashes) to aid disruption and detection.