Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 16:52:06 UTC
Home > List all groups > List all tools > List all groups using tool SpyC23
 Tool: SpyC23
Names SpyC23
Category Malware
Type Backdoor, Info stealer, Downloader, Exfiltration
Description
(SentinelLabs) The Arid Viper group has a long history of using mobile malware,
including at least four Android spyware families and one short-lived iOS implant,
Phenakite. The SpyC23 Android malware family has existed since at least 2019, though
shared code between the Arid Viper spyware families dates back to 2017. It was first
reported in 2020 by ESET in a campaign where the actor used a third-party app store to
distribute weaponized Android packages (APK). That campaign featured several apps
designed to mimic Telegram and Android application update managers.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 28 June 2025
Download this tool card in JSON format
All groups using tool SpyC23
Changed Name Country Observed
APT groups
 Desert Falcons [Gaza] 2011-Oct 2023
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=db9dd5bc-425f-4dfe-ace8-a0e62afbb1f3
Page 1 of 2

1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=db9dd5bc-425f-4dfe-ace8-a0e62afbb1f3
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=db9dd5bc-425f-4dfe-ace8-a0e62afbb1f3
Page 2 of 2