Watchful Sphinx
Discover the adversaries targeting your industry
Back to Adversary Universe
WATCHFUL SPHINX is an Egypt state-nexus adversary that has been active since at least 2016. Historical WATCHFUL SPHINX activity, previously tracked as the GildedShovel activity cluster, relied on email phishing, credential harvesting, and mobile applications enabling surveillance. Contemporary activity indicates an expansion of their capabilities to include the custom Remote Access Tool (RAT) Stea...
-
Watchful Sphinx
-
Egypt, North Africa, Africa
Community Identifiers
NilePhish
Objective
Intelligence Gathering
Motivation
State-Sponsored
Who's targeting your industry?
Today's adversaries are faster, smarter, and better resourced. Know who they are and how to stop them.
View adversaries
CrowdStrike 2025 Threat Hunting Report
Adversaries weaponize and target AI at scale.
