Threat actor
threat_actor:dark_caracal
Threat actor associated in the episode with Bandook-based phishing campaigns against Dominican Republic government organizations; the attribution is presented as uncertain.
Threat actor associated in the episode with Bandook-based phishing campaigns against Dominican Republic government organizations; the attribution is presented as uncertain.
“the malware has been known to be used by a group called Dark Caracal”
“we aren’t sure exactly who they are”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | ASSOCIATED_WITH | Lebanon | Uncertain | 135 |
| incoming | ASSOCIATED_WITH | Bandook | Uncertain | 135 |
| incoming | ATTRIBUTED_TO | The D.R. Incident | Uncertain | 135 |
Bandook ASSOCIATED_WITH Dark Caracal
Jack says Bandook has been known to be used by Dark Caracal, but presents the connection as suggestive rather than certain.
Uncertain Confidence 91% · Jack Rhysider EP 135 Details
“the Bandook malware has been known to be used by a group called Dark Caracal”
Dark Caracal ASSOCIATED_WITH Lebanon
Jack says there are clues suggesting that the Lebanese government is somehow behind Dark Caracal, while noting that the group's identity is not certain.
Uncertain Confidence 88% · Jack Rhysider EP 135 Details
“there are quite a bit of clues that lead us to believe that the Lebanese government is somehow behind this Dark Caracal group”
The D.R. Incident ATTRIBUTED_TO Dark Caracal
The campaign was associated with Dark Caracal in the investigation, but the episode emphasizes that attribution was not clear.
Uncertain Confidence 72% · Omar Avilez EP 135 Details
“it was not just Dark Caracal; it was not just Conti”
“This attribution wasn’t exactly clear”