FORENSIA

THREAT_ACTOR · G0070

Dark Caracal

Also known as: Dark Caracal

Profile

Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.

MITRE ATT&CK ↗

Techniques

12 ATT&CK techniques attributed to this actor.

T1005 Data from Local SystemT1027.002 Software PackingT1027.013 Encrypted/Encoded FileT1059.003 Windows Command ShellT1071.001 Web ProtocolsT1083 File and Directory DiscoveryT1113 Screen CaptureT1189 Drive-by CompromiseT1204.002 Malicious FileT1218.001 Compiled HTML FileT1547.001 Registry Run Keys / Startup FolderT1566.003 Spearphishing via Service

Software

3 malware/tools attributed to this actor.

FinFisherBandookCrossRAT

Related corpus activity

10,058 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Dark Caracal.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-1969cve—851
cve-2025-68670cve—852
cve-2026-3102cve—853
cve-2025-34117cve—851
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2025-11837cve—852
cve-2025-34054cve—854
cve-2014-2321cve—851
cve-2020-17456cve—851
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2021-27076cve—851
cve-2013-3307cve—852
cve-2022-47945cve—851
cve-2016-15047cve—854
cve-2024-1781cve—851
cve-2018-8007cve—851
cve-2025-23304cve—852
cve-2021-4045cve—851
cve-2020-22653cve—852
cve-2020-22658cve—852
cve-2016-5681cve—852
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,058.