Threat Intelligence Tarot
Vol. II · 130
United Arab Emirates
G0038★★★★★
risk 4/5
✦ The Desert Hawk ✦
Stealth Falcon
Project Raven · FruityArmor
Emirati journalistsHuman rights defendersRegional dissidentsForeign policy advisors
Active since ~2012 · Domestic dissident surveillance, Regional opposition tracking
The Desert Hawk circles low over the homes of the noisy. Where journalists and exiles tap into encrypted messengers, this hawk has already perched on their endpoint, listening before encryption is applied.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Citizen Lab disclosure of dissident targeting (2016)
- ◆Karma iOS toolset (former US intelligence personnel involvement reported)
- ◆Windows Update service repurposing for persistence (FruityArmor)
- ◆Reuters Project Raven investigative reporting (2019)
Defenses
- ▸Apple Lockdown Mode deployment for high-risk individualsApple Platform Security Guide
- ▸Mobile device threat hunting (Citizen Lab and Amnesty toolkits)MITRE D3FEND
- ▸Windows service auditing for unexpected modificationsCIS Control 8 ↗
- ▸Civil society organizational threat assistance programsNIST CSF: ID.RA ↗
Reversed: Their Weakness
Hardened mobile device protocols for at-risk journalists and activists, paired with Apple Lockdown Mode and audit-only review of installed configuration profiles, raise the cost of this operator's playbook.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.