Dark CaracalThreat actor
- g0070
Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of writing is believed to be administered out of a building belonging to the Lebanese General Security Directorate in Beirut. At present, we have knowledge of hundreds of gigabytes of exfiltrated data, in 21+ countries, across thousands of victims.From MISP Galaxy
Last reported 1 month ago, by AhnLab ASEC2 reports
ATT&CK techniques
1 technique · each with the sentence it comes from- T1195Supply Chain Compromise
“… APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabi…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
August 2026 Threat Trend Report on APT Groups“Armored Likho, Awaken Likho, Core Werewolf, Dark Caracal, Darkhotel, Head Mare, and OceanLotus (APT32) also carried out attacks exploiting legitimate services and software such as Telegram, GitLab, GitHub, OneDrive, TrueConf, and Sogou Input Method, respectively.”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“Dark Caracal: Suspected Lebanese APT group Dark Caracal has developed new malware, a new modular Go-based framework named GoCaracal.”
Indicators in its reports
named in the reports above- infosec[.]exchangein 1 report
- hxxps://www.techdirt[.]com/2026/08/26/meta-just-paid-nearly-17-billion-to-make-sure-it-gets-to-write-the-kid-safety-rules-for-every-other-social-media-platform/in 1 report
- www.techdirt[.]comin 1 report
- techdirt[.]comin 1 report
- martinmatishak.bsky[.]socialin 1 report
- esetresearch.bsky[.]socialin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.