SYMBOLCOMMON_NAMEaka. SYNONYMS

Dark Caracal  (Back to overview)

aka: G0070

Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of writing is believed to be administered out of a building belonging to the Lebanese General Security Directorate in Beirut. At present, we have knowledge of hundreds of gigabytes of exfiltrated data, in 21+ countries, across thousands of victims. Stolen data includes enterprise intellectual property and personally identifiable information.

Associated Families
jar.crossrat win.bandook
References
2023-12-21 ⋅ Fortinet ⋅ Pei Han Liao
Bandook - A Persistent Threat That Keeps Evolving
Bandook
2023-02-10 ⋅ Electronic Frontier Foundation ⋅ Cooper Quintin
Uncle Sow: Dark Caracal in Latin America
Bandook
2021-07-19 ⋅ Proofpoint ⋅ Joe Wise, Konstantin Klinger, Proofpoint Threat Research Team, Selena Larson
New Threat Actor Uses Spanish Language Lures to Distribute Seldom Observed Bandook Malware
Bandook Caliente Bandits
2021-07-07 ⋅ ESET Research ⋅ Fernando Tavella, Matías Porolli
Bandidos at large: A spying campaign in Latin America
Bandook
2020-12-10 ⋅ Electronic Frontier Foundation ⋅ Cooper Quintin, Eva Galperin
Dark Caracal: You Missed a Spot
Bandook
2020-11-26 ⋅ Checkpoint ⋅ Check Point Research
Bandook: Signed & Delivered
Bandook
2020-11-26 ⋅ Check Point ⋅ Checkpoint Research
Bandook: Signed & Delivered
Bandook Dark Caracal
2019-01-01 ⋅ MITRE ⋅ MITRE ATT&CK
Group description: Dark Caracal
Dark Caracal
2018-01-24 ⋅ Objective-See ⋅ Patrick Wardle
Analyzing CrossRAT: A cross-platform implant, utilized in a global cyber-espionage campaign
CrossRAT
2018-01-18 ⋅ Lookout ⋅ Andrew Blaich, Apurva Kumar, Cooper Quintin, Eva Galperin, Jeremy Richards, Michael Flossman
Dark Caracal: Cyber-espionage at a Global Scal
CrossRAT Bandook Dark Caracal
2016-08-01 ⋅ Electronic Frontier Foundation ⋅ Claudio Guarnieri, Cooper Quintin, Eva Galperin, Morgan Marquis-Boire
Operation Manul
jRAT Bandook
Credits: MISP Project