Operation Arid Viper

Trend Micro describes two related campaigns: Operation Arid Viper — a targeted data‑exfiltration campaign using spear‑phishing (RAR→SCR→EXE) that impersonates Skype, uses pornographic decoys to avoid detection, and targets Israeli government, military, transport and academic institutions; and Operation Advtravel — a less sophisticated C# infostealer/backdoor campaign with publicly exposed C2 directories containing stolen data from ~500+ systems. The report includes detailed infection chains, C2 URL paths and domains, hosting IPs (notably Hetzner/Germany and AWS), sample network captures and User‑Agent strings (SK/Skypee/Skype), numerous SHA‑256 file hashes and Trend Micro detections, victim artifacts (documents, screenshots, keystrokes, mobile SMS/call logs), and attribution indicators linking several online identities and email addresses to the infrastructure and developer artifacts.