216.73.216.128

Desert Scorpion

The MITRE Corporation · Published 11/09/2020 16:54 · Modified 27/03/2026 01:41 Family

Essential information

Confidence
100/100
Is family
Yes
Published
11/09/2020 16:54
Modified
27/03/2026 01:41
Revoked
No
Author / Source
The MITRE Corporation
Related entities
17 attack patterns (mitre), 1 intrusion sets (apt)

Description

[Desert Scorpion](https://attack.mitre.org/software/S0505) is surveillanceware that has targeted the Middle East, specifically individuals located in Palestine. [Desert Scorpion](https://attack.mitre.org/software/S0505) is suspected to have been operated by the threat actor [APT-C-23](https://attack.mitre.org/groups/G1028).(Citation: Lookout Desert Scorpion) There are multiple close variants of [Desert Scorpion](https://attack.mitre.org/software/S0505), such as VAMP(Citation: Unit42 VAMP 2017), GnatSpy(Citation: Trendmicro GnatSpy 2017), [FrozenCell](https://attack.mitre.org/software/S0577) and [SpyC23](https://attack.mitre.org/software/S1195), which add some additional functionality but are not significantly different from the original malware.

Marking (TLP)

Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references