Dark Caracal

Summary

Espionage and hack-for-hire actor (MITRE G0070) that Lookout and the EFF traced in 2018 to a building of Lebanon's General Directorate of General Security (GDGS) in Beirut; active since at least 2012 with mobile (Pallas) and desktop (Bandook/CrossRAT) surveillance of governments, militaries, utilities, financial institutions, journalists and activists in 21+ countries. Positive Technologies tracked a 2024–2025 campaign of 483 Poco RAT samples (a Bandook successor) delivered through finance-themed lures to corporate networks in Venezuela, the Dominican Republic, Colombia, Chile and Spain, attributing it to Dark Caracal as 'a clear match'.

Attribution

General Directorate of General Security

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Lookout / EFF (Research, 2018-01-18)
  Operations traced to a GDGS building in Beirut
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Attributed to the GDGS

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 4

Infrastructure patterns

• Watering-hole websites host its trojanised applications (Pallas) and malicious code (MITRE ATT&CK, 2026)

Reporting and advisories 3

• MITRE ATT&CK
  Dark Caracal (G0070) group profile
• Lookout / EFF
  Dark Caracal: mobile APT
• Positive Technologies
  Evolution of Dark Caracal tools: Poco RAT