Amethyst Rain
VolcanicTimberVolatile Cedar
Microsoft threat actor profile. Origin/Threat: Lebanon.
origin (suspected)
Lebanon
source: misp-galaxy1 refs →
Amethyst Rain· Lebanon
Amethyst Rain is a Lebanon-based threat actor targeting telecommunications, media, and defense sectors in the Middle East.
Analyst brief
Amethyst Rain (VolcanicTimber, Volatile Cedar) is a Lebanon-based threat actor. It primarily targets telecommunications, media, and defense sectors in the Middle East. The group uses open-source pentest tools (Mimikatz, PowerSploit), scans web applications, and collects data through remote access tools. Defenders should focus on patching web server vulnerabilities, monitoring PowerShell logs, and scrutinizing Remote Desktop Protocol (RDP) usage.
unknown
FAQ2
In which region does Amethyst Rain primarily operate?
Amethyst Rain primarily operates in the Middle East region.
Which open-source pentest tools does Amethyst Rain use?
Amethyst Rain uses open-source pentest tools such as Mimikatz and PowerSploit.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.