Dark Caracal
Adversary-emulation profile for Dark Caracal (G0070), a Lebanese state-linked...
Install
npx skills add BitterSecurity/Decepticon --skill dark-caracal -g -a claude-code -y- Repository
- BitterSecurity/Decepticon6.5k
- Category
- Security
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Adversary-emulation profile for Dark Caracal (G0070), a Lebanese state-linked cyber-espionage and surveillance actor attributed to the General Directorate of General Security (GDGS), operating since at least 2012.
Dark Caracal, Adversary Emulation Profile
Dark Caracal (MITRE ATT&CK G0070) is a cyber-espionage and surveillance group attributed to Lebanon's General Directorate of General Security (GDGS), operating since at least 2012. The group is best characterized by its mobile-first surveillance approach, deploying trojanized Android messaging apps (Pallas) to harvest SMS, call logs, contacts, photos, and real-time audio/video, combined with cross-platform desktop RATs (Bandook, CrossRAT) and the commercial spyware FinFisher. Dark Caracal relies on relatively simple social engineering, phishing via Facebook and WhatsApp, watering holes, and trojanized applications masquerading as popular software, rather than advanced zero-day exploitation. Despite this simplicity, the group has compromised thousands of victims across 20+ countries, exfiltrating hundreds of thousands of files and text messages. Evidence suggests the group may also operate as a cyber-mercenary / hack-for-hire entity, conducting campaigns on behalf of other governments (notably Kazakhstan in Operation Manul).
