Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 20:15:37 UTC
Home > List all groups > List all tools > List all groups using tool StealthFalcon
 Tool: StealthFalcon
Names StealthFalcon
Category Malware
Type Backdoor, Exfiltration
Description
(ESET) The Win32/StealthFalcon backdoor, which appears to have been created in 2015,
allows the attacker to control the compromised computer remotely. We have seen a small
number of targets in UAE, Saudi Arabia, Thailand, and the Netherlands; in the latter case, the
target was a diplomatic mission of a Middle Eastern country. How the backdoor was
distributed and executed on the target systems is beyond the scope of this investigation; our
analysis focuses on its capabilities and its C&C communication.
Information Last change to this tool card: 20 April 2020
Download this tool card in JSON format
All groups using tool StealthFalcon
Changed Name Country Observed
APT groups
 Stealth Falcon, FruityArmor 2012-Mar 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d7447c4a-46ca-402a-8b8a-6a572e2983f0
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d7447c4a-46ca-402a-8b8a-6a572e2983f0
Page 1 of 1