Bandook DEVELOPED_BY Prince Ali
Bandook was developed by a person using the name Prince Ali.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“Bandook was developed by a guy who goes by the name Prince Ali.”
Person
person:prince_ali
Also: Ali
Pseudonymous Lebanese malware author associated in the episode with Bandook and related malware signatures.
Pseudonymous Lebanese malware author associated in the episode with Bandook and related malware signatures.
“Bandook was developed by a guy who goes by the name Prince Ali.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | DEVELOPED_BY | Bandook | Explicit | 38 |
| incoming | ASSOCIATED_WITH | Dark Caracal | Uncertain | 38 |
| incoming | ASSOCIATED_WITH | CrossRAT | Uncertain | 38 |
| incoming | ASSOCIATED_WITH | Dark Caracal | Uncertain | 38 |
Bandook DEVELOPED_BY Prince Ali
Bandook was developed by a person using the name Prince Ali.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“Bandook was developed by a guy who goes by the name Prince Ali.”
Dark Caracal ASSOCIATED_WITH Prince Ali
The researchers considered Prince Ali a possible common thread because he wrote Bandook and was Lebanese, but they did not establish that he operated the entire campaign.
Uncertain Confidence 82% · Jack Rhysider EP 38 Details
“I’m starting to think Prince Ali is the common thread to all this.”
CrossRAT ASSOCIATED_WITH Prince Ali
CrossRAT shared a communication scheme with Bandook and Dark Caracal; because Prince Ali wrote Bandook, the researchers said this looked like a possible common authorship clue, not a confirmed attribution.
Uncertain Confidence 84% · Cooper Quinton EP 38 Details
“It looks like the same person wrote all of this malware and we know that Prince Ali wrote Bandook.”
Dark Caracal ASSOCIATED_WITH Prince Ali
Dark Caracal shared a command-and-control communication scheme with Bandook and CrossRAT, suggesting but not proving a connection to Prince Ali.
Uncertain Confidence 84% · Cooper Quinton EP 38 Details
“CrossRAT, Bandook, [00:50:00] and the Dark Caracal mobile malware all use the same scheme to communicate with the command and control servers.”