Dark Caracal INVOLVES Dark Caracal
The Dark Caracal campaign involved mobile malware that the researchers called Dark Caracal.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“When we looked at the mobile malware which we called Dark Caracal”
Campaign
campaign:dark_caracal
Also: Dark Caracal campaign
Cyber-espionage campaign investigated by EFF and Lookout and documented in a forty-nine-page report.
Cyber-espionage campaign investigated by EFF and Lookout and documented in a forty-nine-page report.
“They called that report Dark Caracal.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Dark Caracal | Explicit | 38 |
| outgoing | INVOLVES | Trojanized applications | Explicit | 38 |
| outgoing | TARGETS | Lebanon | Explicit | 38 |
| outgoing | TARGETS | Syria | Explicit | 38 |
| outgoing | TARGETS | Vietnam | Explicit | 38 |
| outgoing | TARGETS | Kazakhstan | Explicit | 38 |
| outgoing | ASSOCIATED_WITH | Ogero Telecom | Explicit | 38 |
| outgoing | ASSOCIATED_WITH | General Directorate of General Security | Uncertain | 38 |
| outgoing | ASSOCIATED_WITH | Prince Ali | Uncertain | 38 |
Dark Caracal INVOLVES Dark Caracal
The Dark Caracal campaign involved mobile malware that the researchers called Dark Caracal.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“When we looked at the mobile malware which we called Dark Caracal”
Dark Caracal INVOLVES Trojanized applications
The campaign used Trojanized applications that remained functional while spying on victims in the background.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“these were all, in addition to being spyware, working versions of the app still.”
Dark Caracal TARGETS Lebanon
Most infections discovered in the expanded investigation involved people in Lebanon or near the Lebanon-Syria border.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“most of the infections are infections of people in Lebanon or on the border of Lebanon and Syria.”
Dark Caracal TARGETS Syria
The investigation found infections among people near the border of Lebanon and Syria.
Explicit Confidence 93% · Cooper Quinton EP 38 Details
“on the border of Lebanon and Syria”
Dark Caracal TARGETS Vietnam
The campaign also targeted at least one Vietnamese cigarette importer and had victims in Vietnam.
Explicit Confidence 96% · Jack Rhysider EP 38 Details
“Then they found another victim; a Vietnamese cigarette importer”
“we’ve got victims in Lebanon, Kazakhstan, the United States, China, France, Germany, India, Italy, Jordan, Nepal, the Netherlands, Pakistan, the Philippines, Qatar, Russia, Saudi Arabia, South Korea, Switzerland, Syria, Thailand, Venezuela, and Vietnam.”
Dark Caracal TARGETS Kazakhstan
The campaign included victims and earlier targets connected with Kazakhstan, although the researchers questioned whether Kazakhstan alone explained the operation.
Explicit Confidence 94% · Cooper Quinton EP 38 Details
“In this map we’ve got victims in Lebanon, Kazakhstan”
Dark Caracal ASSOCIATED_WITH Ogero Telecom
The campaign's command-and-control administrator IP addresses were all associated with Ogero Telecom, which is owned by the Lebanese government.
Explicit Confidence 94% · Cooper Quinton EP 38 Details
“they were all from Ogero Telecom which is owned by the government of Lebanon.”
Dark Caracal ASSOCIATED_WITH General Directorate of General Security
The campaign was strongly, but not conclusively, associated with Lebanon's General Directorate of General Security because test devices and administrator activity pointed to its headquarters.
Uncertain Confidence 90% · Jack Rhysider EP 38 Details
“While it’s not a smoking gun, it strongly suggests that the Lebanese government is behind all of this hacking.”
“It’s the headquarters of Lebanon’s General Directorate of General Security.”
Dark Caracal ASSOCIATED_WITH Prince Ali
The researchers considered Prince Ali a possible common thread because he wrote Bandook and was Lebanese, but they did not establish that he operated the entire campaign.
Uncertain Confidence 82% · Jack Rhysider EP 38 Details
“I’m starting to think Prince Ali is the common thread to all this.”