# Dark Caracal

Adversary-emulation profile for Dark Caracal (G0070), a Lebanese state-linked...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill dark-caracal -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill dark-caracal -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill dark-caracal -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill dark-caracal -g -a gemini-cli -y`

## Description

Adversary-emulation profile for Dark Caracal (G0070), a Lebanese state-linked cyber-espionage and surveillance actor attributed to the General Directorate of General Security (GDGS), operating since at least 2012.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Dark Caracal, Adversary Emulation Profile

Dark Caracal (MITRE ATT&CK **G0070**) is a cyber-espionage and surveillance group attributed to Lebanon's **General Directorate of General Security (GDGS)**, operating since at least 2012. The group is best characterized by its **mobile-first surveillance** approach, deploying trojanized Android messaging apps (Pallas) to harvest SMS, call logs, contacts, photos, and real-time audio/video, combined with cross-platform desktop RATs (Bandook, CrossRAT) and the commercial spyware FinFisher. Dark Caracal relies on relatively simple social engineering, phishing via Facebook and WhatsApp, watering holes, and trojanized applications masquerading as popular software, rather than advanced zero-day exploitation. Despite this simplicity, the group has compromised thousands of victims across 20+ countries, exfiltrating hundreds of thousands of files and text messages. Evidence suggests the group may also operate as a **cyber-mercenary / hack-for-hire** entity, conducting campaigns on behalf of other governments (notably Kazakhstan in Operation Manul).

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/dark-caracal/SKILL.md