Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Dark Caracal · Unknown · assessed origin Lebanon · misp-galaxy + mitre-attack · refreshed 2026-10-06

Dark Caracal

  • G0070

MITRE G0070 ↗

Dark Caracal — ATT&CK roseDC

attack rose · 12 techniques across 7 tactics

Analyst brief

misp-galaxy + mitre-attack

Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of writing is believed to be administered out of a building belonging to the Lebanese General Security Directorate in Beirut. At present, we have knowledge of hundreds of gigabytes of exfiltrated data, in 21+ countries, across thousands of victims. Stolen data includes enterprise intellectual property and personally identifiable information.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

12 techniques · 7 of 15 tactics

  1. Initial access

    2 techniques

  2. Execution

    2 techniques

  3. Persistence

    1 technique

  4. Stealth

    3 techniques

  5. Discovery

    1 technique

  6. Collection

    2 techniques

  7. Command and control

    1 technique

select a technique

Arsenal

3 malware
Malware
Malware · 3ATT&CK
FinFisherS0182 ↗
CrossRATS0235 ↗
BandookS0234 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2018Dark Caracal Cyber-espionage at a Global ScaleLookout ↗

Take it with you

keyless · no signup

References

4 sources
  1. 1.info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_2018011…
  2. 2.research.checkpoint.com/2020/bandook-signed-delivered
  3. 3.attack.mitre.org/groups/G0070
  4. 4.attack.mitre.org/groups/G0070

Track Dark Caracal on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.