Cyber Threat Actor: APT-C-23

APT‑C‑23, also known as Two‑Ta‑iled Scorpion, is a threat actor that has been publicly linked to Hamas and is believed to operate from Palestine. The group uses the aliases APT‑C‑23 and Two‑Tailed Scorpion in open‑source reporting and has been identified in multiple security analyses as a Hamas‑affiliated cyber unit. Its known activity is limited to a small number of reported incidents, all of which involve mobile‑device compromise.

The actor’s targeting has been observed against Israeli military personnel, indicating a focus on the defense sector within the geographic region of Israel. The primary objective demonstrated in the reported operations is the collection of sensitive information such as GPS coordinates, SMS messages, contact lists, device storage contents, and camera access, which aligns with an espionage‑oriented motive rather than financial gain or destructive disruption. Initial access is achieved through social engineering on messaging platforms, where the attackers create fictitious female personas to lure victims into downloading malicious applications. These applications, masquerading as legitimate chat tools like GrixyApp and Catch&See, deliver a mobile remote access trojan that provides the attackers with extensive data‑exfiltration capabilities and remote file execution on the compromised devices.

The most notable campaign attributed to APT‑C‑23 occurred in February 2020, when the group compromised several hundred Israeli soldiers’ mobile devices by distributing the fraudulent GrixyApp and Catch&See applications through deceptive social‑media profiles. The operation was subsequently disrupted by the Israel Defense Forces in cooperation with domestic intelligence agencies, which dismantled the command‑and‑control infrastructure and conducted device disinfection to mitigate further impact. This incident remains the primary publicly documented example of the group’s tactics and objectives.