Dark Caracal INVOLVES Dark Caracal
The Dark Caracal campaign involved mobile malware that the researchers called Dark Caracal.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“When we looked at the mobile malware which we called Dark Caracal”
Malware
malware:dark_caracal
Also: Dark Caracal mobile malware
Mobile spyware described as Trojanized copies of encrypted messaging and privacy applications, with surveillance and data-exfiltration capabilities.
Mobile spyware described as Trojanized copies of encrypted messaging and privacy applications, with surveillance and data-exfiltration capabilities.
“The malware is disguised as copies of WhatsApp, Signal, Telegram, Tor, and Threema”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Trojanized applications | Explicit | 38 |
| outgoing | USES | secureandroid.info | Explicit | 38 |
| outgoing | ASSOCIATED_WITH | Prince Ali | Uncertain | 38 |
| incoming | INVOLVES | Dark Caracal | Explicit | 38 |
Dark Caracal INVOLVES Dark Caracal
The Dark Caracal campaign involved mobile malware that the researchers called Dark Caracal.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“When we looked at the mobile malware which we called Dark Caracal”
Dark Caracal USES Trojanized applications
The mobile malware masqueraded as Trojanized copies of legitimate encrypted-messaging applications.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“The malware is disguised as copies of WhatsApp, Signal, Telegram, Tor, and Threema.”
Dark Caracal USES secureandroid.info
Attackers used secureandroid.info to distribute backdoored, Trojanized copies of messaging applications.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“The attackers have actually set up a website called secureandroid.info that has the back door to Trojanized copies of all of these apps.”
Dark Caracal ASSOCIATED_WITH Prince Ali
Dark Caracal shared a command-and-control communication scheme with Bandook and CrossRAT, suggesting but not proving a connection to Prince Ali.
Uncertain Confidence 84% · Cooper Quinton EP 38 Details
“CrossRAT, Bandook, [00:50:00] and the Dark Caracal mobile malware all use the same scheme to communicate with the command and control servers.”