The Desert Falcons

VIRUS DEFINITION

Virus Type: Malware / Espionage Tool

What is Desert Falcons?

Desert Falcons is a group of cybermercenaries operating from the Middle East and using a set of methods to hide and operate malware. The cybercriminals appear to be highly skilled: in addition to proficient social engineering tricks, they have developed the following from scratch:

Computer systems malware targeting Windows devices
Mobile malware targeting Android devices
Infection vectors, including phishing emails, fake websites and fake social networking accounts

Who are the victims of Desert Falcons?

Potential victims were enticed with socio-political news and information, and many succumbed rapidly to malware infection.

The victims targeted include:

Military and Government
Newspaper, TV/Radio Channels and Top Media Outlets
Financial and Trading Institutions
Research and Education Institutions
Activists and Political Leaders
Energy Firms
Physical Security Companies

Victims of the Desert Falcons are located mainly in the following countries:

Egypt
Palestine
Israel
Jordan

How do I know if I'm infected or not?

The list of indicators of compromise is available on Securelist.com

How can I protect myself against the Desert Falcons campaign?

Kaspersky Lab products detect and block all variants of the malware used in this campaign:

Trojan.Win32.DesertFalcons

Trojan-Spy.Win32.Agent.cncc

Trojan-Spy.Win32.Agent.ctcr

Trojan-Spy.Win32.Agent.ctcv

Trojan-Spy.Win32.Agent.ctcx

Trojan-Spy.Win32.Agent.cree

Trojan-Spy.Win32.Agent.ctbz

Trojan-Spy.Win32.Agent.comn

Trojan.Win32.Bazon.a