- Category
- State · Attributed to a state or working for one.
- Origin
- Lebanon(high confidence)
- Sponsor
- State-sponsored, General Directorate of General Security (GDGS)
- Motivation
- Information theft and espionage
- Seen
- 2007–2026
- Status
- Active
- ATT&CK
- G0070 · 14 techniques
- Sources
- 10 sources carry it
- Identifier
- GINC-APT-0061 · dark-caracal
LebanonWhat it is
Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0070
- Thales
- ATK27
- Operations
- Operation “Dark Caracal”
- Other names
- ATK 27, TAG-CT3
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTLebanon
- MISP Galaxy (CFR tagging)Lebanon
- ThreatActor.info (Malpedia et al.)Lebanon · high
Targets
- Countries
- China, France, Germany, India, Italy, Jordan, Lebanon, Nepal, Netherlands, Pakistan, Philippines, Qatar, Russia, Saudi Arabia, South Korea, Switzerland, Syria, Thailand, United States, Venezuela, Vietnam
- Sectors
- Defense, Education, Financial, Government, Healthcare, Manufacturing, Media, Utilities
Tools
The tools and malware families the sources tie to it.
- Bandook
- CrossRAT
- CrossRat
- Dark DDoSeR
- FinFisher
- Pallas
- Pallas Bandook CrossRAT Infected Documents
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de