Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Volatile Cedar · Unknown · assessed origin Lebanon · misp-galaxy + mitre-attack · refreshed 2026-10-06

Volatile Cedar

  • Lebanese Cedar
  • DeftTorero

MITRE G0123 ↗

Volatile Cedar — ATT&CK roseVC

attack rose · 5 techniques across 4 tactics

Analyst brief

misp-galaxy + mitre-attack

Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

5 techniques · 4 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Initial access

    1 technique

  3. Persistence

    1 technique

  4. Command and control

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
Caterpillar WebShellS0572 ↗
ExplosiveS0569 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2015Volatile Cedar Threat Intelligence And ResearchCheckpoint ↗

Take it with you

keyless · no signup

References

7 sources
  1. 1.blog.checkpoint.com/2015/03/31/volatilecedar
  2. 2.blog.checkpoint.com/2015/06/09/new-data-volatile-cedar
  3. 3.securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421
  4. 4.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf
  5. 5.media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-…
  6. 6.securelist.com/defttorero-tactics-techniques-and-procedures/107610
  7. 7.attack.mitre.org/groups/G0123

Track Volatile Cedar on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.