Skip to content

Dark Caracal

Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.

ATT&CK ID: G0070
Origin: Lebanon
Techniques: 11
Tools: 3

Techniques

Initial Access

Drive-by Compromise Phishing

Execution

Command and Scripting Interpreter User Execution

Persistence

Boot or Logon Autostart Execution

Privilege Escalation

Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information System Binary Proxy Execution

Discovery

File and Directory Discovery

Collection

Data from Local System Screen Capture

Command and Control

Application Layer Protocol

Software

Bandook · CrossRAT · FinFisher

MITRE ATT&CK All threat actors