{
  "name": "Stealth\u202fFalcon and Horus: A Saga of Middle Eastern Cyber Espionage",
  "slug": "stealth-falcon-and-horus-a-saga-of-middle-eastern-cyber-espionage",
  "description": "Check Point Research (CPR) uncovered an active-weaponized Microsoft WebDAV zero\u2011day (CVE\u20112025\u201133053) exploited by the Stealth Falcon APT in a targeted campaign against defense and government organizations across the Middle East and Africa. The attack began with a spear-phishing-disguised .url file that hijacks the working-directory-based execution of legitimate Windows tools (LOLBins) to load malicious executables from a WebDAV server.",
  "published": "2025-06-11T07:26:07+00:00",
  "created_at": "2025-06-11T07:26:07+00:00",
  "modified_at": "2025-06-11T08:22:33+00:00",
  "created_at_opencti": "2025-06-11T07:26:07+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-06-11",
    "CVE-2025-33053",
    "apt",
    "cyberespionage",
    "keylogger",
    "mythic",
    "webdav",
    "zeroday"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "worryfreetransport.com"
      },
      {
        "id": "",
        "name": "summerartcamp.net"
      },
      {
        "id": "",
        "name": "roundedbullets.com"
      },
      {
        "id": "",
        "name": "radiotimesignal.com"
      },
      {
        "id": "",
        "name": "purvoyage.com"
      },
      {
        "id": "",
        "name": "luxuryfitnesslabs.com"
      },
      {
        "id": "",
        "name": "joinushealth.com"
      },
      {
        "id": "",
        "name": "healthherofit.com"
      },
      {
        "id": "",
        "name": "fastfilebackup.com"
      },
      {
        "id": "",
        "name": "downloadessays.net"
      },
      {
        "id": "",
        "name": "cyclingonlineshop.com"
      },
      {
        "id": "",
        "name": "f270202cd88b045630f6d2dec6d5823aa08aa66949b9ccd20f6e924c7992fea7"
      },
      {
        "id": "",
        "name": "e0a44274d5eb01a0379894bb59b166c1482a23fede1f0ee05e8bf4f7e4e2fcc6"
      },
      {
        "id": "",
        "name": "dec6dda0559e381c23f1dfbe92fa4705c8455430f8278c78c170a7533b703296"
      },
      {
        "id": "",
        "name": "ddce79afe9f67b78e83f6e530c3e03265533eb3f4530e7c89fdc357f7093a80b"
      },
      {
        "id": "",
        "name": "dc7cb53c5dc2e756822328a7144c29318cb871890727eff9c8da64a01e8e782d"
      },
      {
        "id": "",
        "name": "db7364296cc8f78981797ffb2af7063bba97e2f6631c29215d59f4979f8b4fce"
      },
      {
        "id": "",
        "name": "da3bb6e38b3f4d83e69d31783f00c10ce062abd008e81e983a9bd4317a9482aa"
      },
      {
        "id": "",
        "name": "cd6335101e0187c33a78a316885a2cbf4cbbd2a72daf64a086edb4a2615749fb"
      },
      {
        "id": "",
        "name": "c5b00e8312e801dc35652c631a14270ed4eec8f6d90d08cdde3c6e7fd1ec24b6"
      },
      {
        "id": "",
        "name": "ba5beb189d6e1811605b0a4986b232108d6193dcf09e5b2a603ea4448e6f263c"
      },
      {
        "id": "",
        "name": "aa612f53e03539cdc8f8a94deee7bf31f0ac10734bb9301f4506b9113c691c97"
      },
      {
        "id": "",
        "name": "9ed8f51548a004ac61b7176df12a0064dc3096088cbf3c644a9abdb5c92936f7"
      },
      {
        "id": "",
        "name": "9a82e21c2463d6c23a48409a862e668ed9c205468d216d2280f7debe1ab1ddd8"
      },
      {
        "id": "",
        "name": "8291b886cce1f0474db5b3dc269adf31d1659b7d949f62ea23608409d14b9ceb"
      },
      {
        "id": "",
        "name": "8065c85e387654cb79a12405ff0f99fd4ddd5a5d3b9876986b82822bd10c716f"
      },
      {
        "id": "",
        "name": "700b422556f070325b327325e31ddf597f98cc319f29ef8638c7b0508c632cee"
      },
      {
        "id": "",
        "name": "62797e28a334e392cb56fcc26dd07f04ac031110f0e9ed8489ec0825beea75eb"
      },
      {
        "id": "",
        "name": "66a893728a0ac1a7fae39ee134ad4182d674e719219fbf5d9b7cd4fd4f07f535"
      },
      {
        "id": "",
        "name": "50a2b6c1b0a0d308e8016aece9629c1bf6ca4ecc6f4cef34c904e9c3e82355fb"
      },
      {
        "id": "",
        "name": "5671b3a89c0e88a9bfb0bd5bc434fa5245578becfdeb284f4796f65eecbd6f15"
      },
      {
        "id": "",
        "name": "4e045c83cf429210e71e324adccad8818540b9805a44c8d79a8c16c3d5f6fbb6"
      },
      {
        "id": "",
        "name": "46c95af6fea41b55fa0ab919ec81d38a584e32a519f85812fe79a5379457f111"
      },
      {
        "id": "",
        "name": "3b83250383c2a892e0ca86e54fcc6aca9960fc4b425ab9853611ff3e5aa2f9c6"
      },
      {
        "id": "",
        "name": "32f2773ceb6503f8a1c3e456d34ceda5c188974a115e5225a1315e7ec3f8eb5e"
      },
      {
        "id": "",
        "name": "3259ecfb96d3d7e2d1a782b01073e02b3488a3922fd2fd35c20eeb5f44b292ec"
      },
      {
        "id": "",
        "name": "257c63a9e21b829bb4b9f8b0e352379444b0e573176530107a3e6c279d1919da"
      },
      {
        "id": "",
        "name": "1d95a44f341435da50878eea1ec0a1aab6ae0ee91644c497378266290a6ef1d8"
      },
      {
        "id": "",
        "name": "092c344330bd5cba71377dead11946f7277f2dd4af57f5b636b70b343bc7ebe0"
      },
      {
        "id": "",
        "name": "0598e1af6466b0813030d44fa64616eea7f83957d70f2f48376202c3179bd6b1"
      }
    ],
    "malware": [
      {
        "id": "4ae1dc95-bda9-4a17-9cb8-1fd75474458e",
        "name": "Mythic - S0699",
        "slug": "mythic-s0699"
      }
    ],
    "attack_patterns": [
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "88fa397b-4cc9-42c0-b52d-4108f9630529",
        "name": "T1095"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Qatar"
      },
      {
        "id": "",
        "name": "Yemen"
      },
      {
        "id": "",
        "name": "Egypt"
      },
      {
        "id": "",
        "name": "T\u00fcrkiye"
      },
      {
        "id": "",
        "name": "Defense"
      }
    ]
  },
  "external_refs": [
    "https://research.checkpoint.com/2025/stealth-falcon-zero-day/",
    "https://otx.alienvault.com/pulse/68494baf27507539fd31918c"
  ]
}