Threat Lab PART_OF Electronic Frontier Foundation
The Threat Lab is a project within the Electronic Frontier Foundation.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“Electronic Frontier Foundation has a new project called Threat Lab.”
Episode
14 May 2019 Official episode · Official transcript
mercenary advanced persistent threat
The episode examines Operation Manul and the later Dark Caracal investigation into malware, mobile spyware, command-and-control infrastructure, and suspected government-linked cyber-mercenary activity.
Topics: Targeted spear phishing, Remote-access trojans, Cross-platform malware, Android mobile spyware, Trojanized messaging applications, Command-and-control infrastructure, Data exfiltration, Open directory exposure, Server log analysis, Wi-Fi SSID geolocation, GeoIP victim mapping, Cyber-mercenary services, Threat attribution, Government-linked cyber-espionage, Stalkerware
Links published on the Darknet Diaries episode page. Not LLM output.
No Sources heading on this episode page.
Qualified statements from this episode, not graph facts.
Threat Lab PART_OF Electronic Frontier Foundation
The Threat Lab is a project within the Electronic Frontier Foundation.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“Electronic Frontier Foundation has a new project called Threat Lab.”
Cooper Quinton MEMBER_OF Threat Lab
Cooper Quinton identifies himself as a senior staff technologist on the EFF Threat Lab.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“I am a senior staff technologist on EFF’s Threat Lab.”
Irina Petrushova MEMBER_OF Respublika
Irina Petrushova was the editor in chief of Respublika.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“Irina Petrushova who is the Editor in Chief of Independent Newspaper which is formally out of Kazakhstan called Respublika.”
Operation Manul INVOLVES Irina Petrushova
Operation Manul began in the context of EFF representing Irina Petrushova, who was targeted after reporting on Kazakhstan's government.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“Operation Manul started when the EFF was representing a woman named Irina Petrushova”
Operation Manul INVOLVES Respublika
The campaign involved targeting people connected with Respublika and its reporting.
Explicit Confidence 95% · Cooper Quinton EP 38 Details
“the people who were going after Respublika and after Irina Petrushova”
Operation Manul INITIAL_ACCESS_VIA spear phishing
The campaign initially targeted Irina, her brother, and associates with spear-phishing emails carrying malicious attachments.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“she and her brother who is also an editor started receiving spear phishing e-mails”
Operation Manul INVOLVES jRat
Malicious attachments used in the campaign downloaded jRat.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“when you open these attachments it will go download a piece of malware called jRat.”
Operation Manul INVOLVES Bandook
The campaign also used Bandook as a second piece of malware.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“a second piece of malware which also was discovered called Bandook.”
Bandook DEVELOPED_BY Prince Ali
Bandook was developed by a person using the name Prince Ali.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“Bandook was developed by a guy who goes by the name Prince Ali.”
Operation Manul INVOLVES command and control server
The campaign used command-and-control servers to communicate with the malware and receive stolen files.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“We started looking into the malware and we find the command and control servers.”
Operation Manul ASSOCIATED_WITH Kazakhstan
The researchers believed the people targeting Respublika and Irina were likely acting on behalf of Kazakhstan, but described the evidence as circumstantial.
Uncertain Confidence 88% · Cooper Quinton EP 38 Details
“were likely doing this on behalf of the government of Kazakhstan”
“we have a pretty good link to Kazakhstan although no – it’s all circumstantial evidence.”
Operation Manul INVOLVES Pallas
Lookout found mobile malware communicating with domains associated with Operation Manul and believed it was related to the campaign.
Attributed Confidence 95% · Cooper Quinton EP 38 Details
“We think that it’s related to Operation Manul.”
Lookout researchers found Pallas while searching their mobile-malware database for samples communicating with Operation Manul domains.
Explicit Confidence 96% · Cooper Quinton EP 38 Details
“after a little while they find some malware which is talking to the same domains that we had discovered”
Dark Caracal INVOLVES Dark Caracal
The Dark Caracal campaign involved mobile malware that the researchers called Dark Caracal.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“When we looked at the mobile malware which we called Dark Caracal”
Dark Caracal USES Trojanized applications
The mobile malware masqueraded as Trojanized copies of legitimate encrypted-messaging applications.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“The malware is disguised as copies of WhatsApp, Signal, Telegram, Tor, and Threema.”
Dark Caracal USES secureandroid.info
Attackers used secureandroid.info to distribute backdoored, Trojanized copies of messaging applications.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“The attackers have actually set up a website called secureandroid.info that has the back door to Trojanized copies of all of these apps.”
Dark Caracal INVOLVES Trojanized applications
The campaign used Trojanized applications that remained functional while spying on victims in the background.
Explicit Confidence 99% · Cooper Quinton EP 38 Details
“these were all, in addition to being spyware, working versions of the app still.”
Dark Caracal TARGETS Lebanon
Most infections discovered in the expanded investigation involved people in Lebanon or near the Lebanon-Syria border.
Explicit Confidence 98% · Cooper Quinton EP 38 Details
“most of the infections are infections of people in Lebanon or on the border of Lebanon and Syria.”
Dark Caracal TARGETS Syria
The investigation found infections among people near the border of Lebanon and Syria.
Explicit Confidence 93% · Cooper Quinton EP 38 Details
“on the border of Lebanon and Syria”
Dark Caracal TARGETS Vietnam
The campaign also targeted at least one Vietnamese cigarette importer and had victims in Vietnam.
Explicit Confidence 96% · Jack Rhysider EP 38 Details
“Then they found another victim; a Vietnamese cigarette importer”
“we’ve got victims in Lebanon, Kazakhstan, the United States, China, France, Germany, India, Italy, Jordan, Nepal, the Netherlands, Pakistan, the Philippines, Qatar, Russia, Saudi Arabia, South Korea, Switzerland, Syria, Thailand, Venezuela, and Vietnam.”
Dark Caracal TARGETS Kazakhstan
The campaign included victims and earlier targets connected with Kazakhstan, although the researchers questioned whether Kazakhstan alone explained the operation.
Explicit Confidence 94% · Cooper Quinton EP 38 Details
“In this map we’ve got victims in Lebanon, Kazakhstan”
Dark Caracal ASSOCIATED_WITH Ogero Telecom
The campaign's command-and-control administrator IP addresses were all associated with Ogero Telecom, which is owned by the Lebanese government.
Explicit Confidence 94% · Cooper Quinton EP 38 Details
“they were all from Ogero Telecom which is owned by the government of Lebanon.”
Dark Caracal ASSOCIATED_WITH General Directorate of General Security
The campaign was strongly, but not conclusively, associated with Lebanon's General Directorate of General Security because test devices and administrator activity pointed to its headquarters.
Uncertain Confidence 90% · Jack Rhysider EP 38 Details
“While it’s not a smoking gun, it strongly suggests that the Lebanese government is behind all of this hacking.”
“It’s the headquarters of Lebanon’s General Directorate of General Security.”
Dark Caracal ASSOCIATED_WITH Prince Ali
The researchers considered Prince Ali a possible common thread because he wrote Bandook and was Lebanese, but they did not establish that he operated the entire campaign.
Uncertain Confidence 82% · Jack Rhysider EP 38 Details
“I’m starting to think Prince Ali is the common thread to all this.”
CrossRAT ASSOCIATED_WITH Prince Ali
CrossRAT shared a communication scheme with Bandook and Dark Caracal; because Prince Ali wrote Bandook, the researchers said this looked like a possible common authorship clue, not a confirmed attribution.
Uncertain Confidence 84% · Cooper Quinton EP 38 Details
“It looks like the same person wrote all of this malware and we know that Prince Ali wrote Bandook.”
Dark Caracal ASSOCIATED_WITH Prince Ali
Dark Caracal shared a command-and-control communication scheme with Bandook and CrossRAT, suggesting but not proving a connection to Prince Ali.
Uncertain Confidence 84% · Cooper Quinton EP 38 Details
“CrossRAT, Bandook, [00:50:00] and the Dark Caracal mobile malware all use the same scheme to communicate with the command and control servers.”
Kazakhstan USES Arcanum Global Intelligence
According to leaked government emails, Kazakhstan's president contracted Arcanum Global Intelligence for a surveillance and cyber-operation mission.
Attributed Confidence 98% · Cooper Quinton EP 38 Details
“the President of Kazakhstan had taken out a contract with a private intelligence company called Arcanum Global Intelligence”
Kazakhstan USES Hacking Team
The episode says leaked Hacking Team emails showed Kazakhstan trying to hire Hacking Team for hacking work.
Attributed Confidence 95% · Cooper Quinton EP 38 Details
“Kazakhstan trying to hire Hacking Team to do some hacking.”
Lebanon USES Hacking Team
The episode says leaked Hacking Team emails showed Lebanon trying to hire Hacking Team for hacking work.
Attributed Confidence 95% · Cooper Quinton EP 38 Details
“Lebanon trying to hire Hacking Team to do some hacking”
Electronic Frontier Foundation ASSOCIATED_WITH Lookout
EFF and Lookout collaborated on investigating the mobile malware and the broader campaign.
Explicit Confidence 99% · Jack Rhysider EP 38 Details
“The team at EFF and the team at Lookout, they team up”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T05:51:44.084801+00:00