Volatile Cedar (Lebanese Cedar) is a Lebanese cyber-espionage group active since 2012, assessed as aligned with Hezbollah, that targets telecom, ISP, hosting, and defense organizations — including Israeli and regional victims — via web-server exploitation and its custom Explosive RAT.
Additional names this actor is known by across other vendors' naming schemes — cross-referenced from external crosswalk sources, not RaqibCTI's own curated aliases (shown at the top of this page). Each source is attributed to its own licence.
Volatile Cedar was first documented by Check Point in March 2015 and revisited by ClearSky in January 2021 as 'Lebanese Cedar'; MITRE tracks it as G0123. The group is assessed with medium confidence as a Lebanese actor aligned with Hezbollah's political and ideological interests, distinguished by a patient, stealth-focused operating style that kept it undetected for years.
Operationally the group favors compromising public-facing web servers — via vulnerability scanning and exploitation (including SQL injection) — as its primary initial-access vector, then deploying the custom Explosive RAT (a modular information-stealer with keylogging and self-updating capabilities) and web shells. Its emphasis on internet-facing servers rather than spearphishing, and its careful operational security, allowed long-dwell collection against communications infrastructure.
MENA and regional targeting is central. ClearSky's 2021 reporting documented compromises of telecommunications companies, ISPs, and hosting providers, with victims including Israeli, Lebanese, Palestinian, Egyptian, Saudi, and other regional and global organizations — targeting that supports surveillance of communications infrastructure aligned to Hezbollah intelligence interests.
Distinct Volatile Cedar / Lebanese Cedar activity has not been prominently re-reported since the 2021 ClearSky disclosure, so the group is assessed as dormant under this name. It is included as a rare non-Iran Levantine-nexus historical entry, flagged medium confidence on the Hezbollah linkage.