H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Stealth Falcon](https://attack.mitre.org/groups/G0038) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)

16 recorded

Relationships

uses

to Command and Scripting Interpreter

Technique

uses

to Credentials from Password Stores

Technique

uses

to Credentials from Web Browsers

Technique

uses

to Data from Local System

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

to Scheduled Task

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Credential Manager

Technique

uses

to Windows Management Instrumentation

Technique

3 external

References

mitre-attack

G0038

Stealth Falcon

—

Citizen Lab Stealth Falcon May 2016

https://citizenlab.org/2016/05/stealth-falcon/