Lebanese Cedar

Summary

Lebanese espionage group (MITRE G0123, Volatile Cedar) active since 2012, which ClearSky links through 'several indications' to the Hezbollah Cyber Unit. It compromises internet-facing web servers and plants Caterpillar web shells and the Explosive RAT. ClearSky's Jan 2021 report found 254 infected servers from a 2020 campaign, mostly in Europe and the US but also in the UAE, Egypt, Saudi Arabia, Jordan, Israel, Lebanon and the Palestinian Authority, including telecom and hosting providers.

Attribution

Possible Hezbollah Cyber Unit link (ClearSky)

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Lebanese threat group
• ClearSky (Research, 2021-01-28)
  Several indications of a Hezbollah Cyber Unit link

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 2

Infrastructure patterns

• Tiered C&C: C&C, static and DGA-driven dynamic update servers; new seed flashplayergetadobe (Check Point, 2015)
• Some C2 servers hosted in Lebanon; some domains once registered to Lebanese addresses (Check Point, 2015)

Reporting and advisories 4

• ClearSky
  'Lebanese Cedar' APT — global web-server espionage campaign (Explosive RAT v4, Caterpillar v2), Jan 2021
• MITRE ATT&CK
  Lebanese Cedar (G0123) group profile
• Check Point Research
  New Data: Volatile Cedar Malware Campaign (Jun 2015)
• Check Point (Virus Bulletin 2015)
  The Unbearable Lightness of APTing — Volatile Cedar (Sep 2015)