Dark Caracal
Overview
Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.
Naming & attribution
It uses 12 documented ATT&CK techniques — more than 35% of the 174 groups tracked here. Activity attributed since at least 2012.
| Name | First reported by |
|---|---|
| Dark Caracal | Blaich, A., et al |
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- APT18 China — 5 shared techniques (26% overlap)
- Elderwood China — 4 shared techniques (24% overlap)
- Inception Russia — 6 shared techniques (21% overlap)
- Darkhotel South Korea — 6 shared techniques (20% overlap)
- Windshift — 5 shared techniques (19% overlap)
- RTM Russia — 3 shared techniques (19% overlap)
Malware families with tracked indicators
One family attributed to Dark Caracal, with 165 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-26). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.
- CrossRAT 165 indicators
Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.
Capabilities
- Custom malware/implant development — ATT&CK: 3 attributed custom malware families
TTPs — 12 techniques across 7 tactics
Initial Access
-
T1189Drive-by Compromise -
T1566.003Spearphishing via Service
Execution
-
T1059.003Windows Command Shell -
T1204.002Malicious File
Persistence
-
T1547.001Registry Run Keys / Startup Folder
Stealth
-
T1027.002Software Packing -
T1027.013Encrypted/Encoded File -
T1218.001Compiled HTML File
Discovery
Collection
-
T1005Data from Local System -
T1113Screen Capture
Command and Control
-
T1071.001Web Protocols
Tools & malware (3)
FinFisher · CrossRAT · Bandook
Reporting (1)
- Dark Caracal: Cyber-espionage at a Global Scale — Blaich, A., et al