NEW: Group Profiler — instant APT intel lookup. Try it →

Dark Caracal

G0070 MITRE ATT&CK →

Overview

Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.

Naming & attribution

Dark Caracal is tracked under 1 names across the industry. It uses 12 documented ATT&CK techniques — more than 35% of the 174 groups tracked here. Activity attributed since at least 2012.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
NameFirst reported by
Dark CaracalBlaich, A., et al

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

  • APT18 China — 5 shared techniques (26% overlap)
  • Elderwood China — 4 shared techniques (24% overlap)
  • Inception Russia — 6 shared techniques (21% overlap)
  • Darkhotel South Korea — 6 shared techniques (20% overlap)
  • Windshift — 5 shared techniques (19% overlap)
  • RTM Russia — 3 shared techniques (19% overlap)

Malware families with current indicators

3 families attributed to Dark Caracal, carrying 142 indicators currently tracked from abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL. MITRE documents what a group does; this is what its tooling is doing now.

  • CrossRAT 121 indicators
  • Bandook 18 indicators
  • FinFisher 3 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

  • Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 12 techniques across 7 tactics

Initial Access

Execution

Persistence

Stealth

Discovery

Collection

Command and Control

Tools & malware (3)

FinFisher · CrossRAT · Bandook

Reporting (1)

Need the matrix overlay, mind-map, or technique-flow view? Open the interactive Group Profiler in a browser with JavaScript enabled.