apt

Dark Caracal

activeAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Dark Caracal

Attribution

Attributed by Lookout/EFF to the Lebanese General Directorate of General Security (GDGS); some recent operations may reflect a mercenary/for-hire model

Origin

Lebanon

First seen

2018

Last active

2025

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Lebanon (origin); global victims in 20+ countries incl. MENA

Sectors

Military, government, activists, individuals

MITRE ATT&CK

G0070 ↗

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Lebanon (origin); global victims in 20+ countries incl. MENA (Military, government, activists sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Infy / Prince of PersiaactorTechnique overlap
Madi / MahdiactorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap
BahamutactorTechnique overlap
Imperial Kitten (CURIUM)actorTechnique overlap
StrongPity (PROMETHIUM)actorTechnique overlap
SideWinderactorTechnique overlap
Scarred Manticore (Storm-0861)actorTechnique overlap

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?

Uses

Web ProtocolstechniqueATT&CK mapping
Registry Run Keys / Startup FoldertechniqueATT&CK mapping
Software PackingtechniqueATT&CK mapping
Drive-by CompromisetechniqueATT&CK mapping
Data from Local SystemtechniqueATT&CK mapping
Windows Command ShelltechniqueATT&CK mapping
Spearphishing via ServicetechniqueATT&CK mapping
Malicious FiletechniqueATT&CK mapping
Compiled HTML FiletechniqueATT&CK mapping
Screen CapturetechniqueATT&CK mapping
Encrypted/Encoded FiletechniqueATT&CK mapping
File and Directory DiscoverytechniqueATT&CK mapping