kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · PS

AridViper

also tracked as apt c 23 1, arid gopher 1, arid viper 1

1 story · 1 in the wild · October 31, 2026 – October 31, 2026

evidence: 1 observed

how they got in

  • phishing email 1 · Oct 31

sectors

  • government 1 · Oct 31
  • nonprofit 1 · Oct 31

geography

  • middle east 1 · Oct 31
  • north africa 1 · Oct 31

malware and tools

  • arid gopher 1 · Oct 31

techniques

  • execution 1 · Oct 31
  • macro 1 · Oct 31
  • persistence 1 · Oct 31
  • steganography 1 · Oct 31

attack phases seen

  • Command and control 1 · Oct 31
  • Execution 1 · Oct 31
  • Initial access 1 · Oct 31
  • Persistence 1 · Oct 31

what we reported, newest first, grouped by story

October 31, 2026

  • Nextron detailed two espionage chains against Arabic-speaking government, HR, diplomatic, student and NGO targets, built from fourteen files collected May–August 2026. Chain one: a macro document with reversed strings fetches an HTA over WMI, which strips the Zone.Identifier from an Arabic questionnaire decoy and XOR-extracts a Go backdoor from a PNG (key byte read from the image), persisting as Run value HostHelpLoader and beaconing to mmarketplaces[.]com. Chain two delivers a C++ libcurl implant inside a 200 MiB VHDX so the payload never receives Mark-of-the-Web, persisting via a Startup .lnk — or a scheduled task when Kaspersky is present — and skipping persistence entirely when it finds no AV. One sample is ESET's Arid Gopher (Arid Viper/APT-C-23) with high confidence; the two campaigns match no published indicator, so attribution there is moderate (Nextron). · Oct 31 · observed · via phishing email · as arid gopher, arid viper, apt c 23 · Threat Intelligence