Dark Caracal (G0070) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

About Dark Caracal

Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.

View MITRE record ↗

Techniques by Tactic (12)

Initial Access

T1189 Drive-by CompromiseT1566.003 Spearphishing via Service

Execution

T1059.003 Windows Command ShellT1204.002 Malicious File

Persistence

T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.002 Software PackingT1027.013 Encrypted/Encoded FileT1218.001 Compiled HTML File

Discovery

T1083 File and Directory Discovery

Collection

T1005 Data from Local SystemT1113 Screen Capture

Command & Control

T1071.001 Web Protocols

Toolsets (3)

🐛

Bandook S0234

Malware · Windows

🐛

CrossRAT S0235

Malware · Linux, Windows, macOS

🐛

FinFisher S0182

Malware · Windows, Android

CVEs Referenced (1)

CVE-2017-8625View full details on NVD

References & Reports (1)

Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

↑