APT-C-23

IntrusionSet · ATTACK:mobile:G1028

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:mobile:G1028",
  "title": "APT-C-23",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1028",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--8332952e-b86b-486b-acc3-1c2a85d39394",
  "external_id": "G1028",
  "domain": "mobile",
  "created": "2024-03-26T18:38:00.759Z",
  "modified": "2026-07-31T20:48:39.666Z",
  "version": "1.0",
  "aliases": [
    "APT-C-23",
    "Mantis",
    "Arid Viper",
    "Desert Falcon",
    "TAG-63",
    "Grey Karkadann",
    "Big Bang APT",
    "Two-tailed Scorpion"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Big Bang APT"
    },
    {
      "source_name": "Grey Karkadann"
    },
    {
      "source_name": "Mantis"
    },
    {
      "source_name": "Two-tailed Scorpion"
    },
    {
      "source_name": "Arid Viper"
    },
    {
      "source_name": "Desert Falcon"
    },
    {
      "source_name": "fb_arid_viper",
      "url": "https://web.archive.org/web/20231126111812/https:/about.fb.com/wp-content/uploads/2021/04/Technical-threat-report-Arid-Viper-April-2021.pdf"
    },
    {
      "source_name": "sentinelone_israel_hamas_war",
      "url": "https://web.archive.org/web/20240208234008/www.sentinelone.com/labs/the-israel-hamas-war-cyber-domain-state-sponsored-activity-of-interest/"
    },
    {
      "source_name": "checkpoint_interactive_map_apt-c-23",
      "url": "https://web.archive.org/web/20230604112435/https://research.checkpoint.com/2018/interactive-mapping-of-apt-c-23/"
    },
    {
      "source_name": "welivesecurity_apt-c-23",
      "url": "https://web.archive.org/web/20201123042131/www.welivesecurity.com/2020/09/30/aptc23-group-evolves-its-android-spyware/"
    },
    {
      "source_name": "symantec_mantis",
      "url": "https://web.archive.org/web/20231227054130/https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/mantis-palestinian-attacks"
    }
  ]
}

Explicit source assertions (7)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.