Dark Caracal
Also reported as ATK 27 and TAG-CT3. Linked to Lebanon by three sources.
Reports per quarter
Techniques seen in the last two years
- T1027.002 2 reports in ATT&CK
- T1027.013 2 reports in ATT&CK
- T1055 2 reports reports only
- T1059.003 2 reports in ATT&CK
- T1082 2 reports reports only
- T1132.001 2 reports reports only
- T1204.002 2 reports in ATT&CK
- T1566.001 2 reports reports only
- T1571 2 reports reports only
- T1583.003 2 reports reports only
Show all 13 techniques Show fewer
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2017-11882 KEV ransomware
- CVE-2019-0803 KEV ransomware
- CVE-2021-44228 KEV ransomware
- CVE-2022-42475 KEV ransomware
- CVE-2022-47966 KEV ransomware
- CVE-2023-23397 KEV
- CVE-2023-2868 KEV
- CVE-2023-28771 KEV
- CVE-2023-38831 KEV ransomware
- CVE-2023-42793 KEV ransomware
- CVE-2023-4966 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Uncle Sow- Dark Caracal in Latin America
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Uncle Sow- Dark Caracal in Latin America
-
Bandidos at large- A spying campaign in Latin America
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bandidos at large- A spying campaign in Latin America
Show all 24 reports Show fewer
-
Dark Caracal- You Missed a Spot
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Dark Caracal- You Missed a Spot
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Bandook- Signed & Delivered
-
Bandook_ Signed & Delivered - Check Point Research
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Bandook_ Signed & Delivered - Check Point Research
-
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Stealth Mango and Tangelo- Nation state mobile surveillanceware stealing data from military & government officials
-
Analyzing CrossRAT- A cross-platform implant, utilized in a global cyber-espionage campaign
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Analyzing CrossRAT- A cross-platform implant, utilized in a global cyber-espionage campaign
-
Dark Caracal Cyber-espionage at a Global Scale
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Dark Caracal Cyber-espionage at a Global Scale
Newest first. Details opens the report in Explore.