- Category
- State · Attributed to a state or working for one.
- Origin
- Lebanon(high confidence)
- Sponsor
- State-sponsored, Hezbollah
- Motivation
- Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0123 · 5 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0038 · volatile-cedar
LebanonWhat it is
Volatile Cedar is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. Volatile Cedar has been operating since 2012 and is motivated by political and ideological interests.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Amethyst Rain
- MITRE ATT&CK
- G0123
- Other names
- Dancing Salome, DeftTorero, Lebanese Cedar, VolcanicTimber
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTLebanon
- MISP Galaxy (CFR tagging)Lebanon
- MicrosoftLebanon
- ThreatActor.info (Malpedia et al.)Lebanon · high
Targets
- Countries
- Canada, Egypt, Israel, Jordan, Lebanon, Middle East, Russia, Saudi Arabia, Ukraine, United Arab Emirates, United Kingdom, United States
- Sectors
- Education, Government, Government, Administration, Think Tanks
Tools
The tools and malware families the sources tie to it.
- Caterpillar 2
- Caterpillar WebShell
- Explosive
- Hacking Team UEFI Rootkit
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de