Dark Caracal G0070

Overview 36 indicators

Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.

Techniques 13 ATT&CK

Open in ATT&CK Navigator → or download the layer (13 techniques, layer 4.5)

• T1005 Data from Local System
• T1027.002 Software Packing
• T1027.013 Encrypted/Encoded File
• T1059.003 Windows Command Shell
• T1071.001 Web Protocols
• T1083 File and Directory Discovery
• T1113 Screen Capture
• T1189 Drive-by Compromise
• T1204.002 Malicious File
• T1218.001 Compiled HTML File
• T1437.001 Web Protocols
• T1547.001 Registry Run Keys / Startup Folder
• T1566.003 Spearphishing via Service

Software 4

• FinFisher
• Bandook
• CrossRAT
• Pallas

Principal sources 3 reports

Ranked by how many of this actor's indicators each report brought in.

• 36info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Cara…
• 36virustotal.com/gui/file/fb101e91397dddbdf7aeb799cb3651…
• 36virustotal.com/gui/file/ce583821191345274cd954b2db7da9…

Timeline 36 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2024-08-02 35 domain, 1 url2 yrs ago

   info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Cara… · virustotal.com/gui/file/fb101e91397dddbdf7aeb799cb3651… · virustotal.com/gui/file/ce583821191345274cd954b2db7da9…

   domain	accountslogin.services
   domain	adobe-flashviewer.accountslogin.services
   domain	adobeair.net
   domain	adobeinstall.com
   domain	ancmax.com
   domain	arablivenews.com
   domain	arabpublisherslb.com
   domain	axroot.com
   domain	dropboxonline.com
   domain	ecowatchasia.com
   domain	etn9.com
   domain	fbtweets.net
   domain	globalmic.net
   domain	gsec.in
   domain	iceteapeach.com
   domain	jaysonj.no-ip.biz
   domain	kaliex.net
   domain	mangoco.net
   domain	mecodata.com
   domain	megadeb.com
   domain	nancyrazzouk.com
   domain	nvidiaupdate.com
   domain	opwalls.com
   domain	orange2015.net
   domain	paktest.ddns.net
   domain	planethdx.com
   domain	playermea.com
   domain	roxsoft.net
   domain	sabisint.com
   domain	secureandroid.info
   domain	skypeservice.no-ip.org
   domain	skypeupdate.com
   domain	tenoclock.net
   domain	tweetsfb.com
   domain	watermelon2017.com
   url	cma-cgrm.com/ebusiness/ne.abc

   copy batch

Further reading 4

• attack.mitre.org/groups/G0070
• info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Cara…
• virustotal.com/gui/file/ce583821191345274cd954b2db7da9…
• virustotal.com/gui/file/fb101e91397dddbdf7aeb799cb3651…