Dark Caracal

Overview

Dark Caracal is threat group that has been attributed to the Lebanese General Directorate of General Security (GDGS) and has operated since at least 2012.

Naming & attribution

It uses 12 documented ATT&CK techniques — more than 35% of the 174 groups tracked here. Activity attributed since at least 2012.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
Dark Caracal	Blaich, A., et al

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

APT18 China — 5 shared techniques (26% overlap)
Elderwood China — 4 shared techniques (24% overlap)
Inception Russia — 6 shared techniques (21% overlap)
Darkhotel South Korea — 6 shared techniques (20% overlap)
Windshift — 5 shared techniques (19% overlap)
RTM Russia — 3 shared techniques (19% overlap)

Malware families with tracked indicators

One family attributed to Dark Caracal, with 256 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

CrossRAT256 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 12 techniques across 7 tactics

Stealth

Discovery

T1083File and Directory Discovery

Collection

T1005Data from Local System
T1113Screen Capture

Command and Control

T1071.001Web Protocols

Tools & malware (3)

FinFisher · CrossRAT · Bandook

Reporting (1)

Dark Caracal: Cyber-espionage at a Global Scale — Blaich, A., et al