Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal2, a persistent and proli c actor, who at the timeof writing is believed to be administered out of a building belonging to the Lebanese General Security Directorate in Beirut. Atpresent, we have knowledge of hundreds of gigabytes of ex ltrated data, in 21+ countries, across thousands of victims. Stolen data includes enterprise intellectual property and personally identi able information. We are releasing more than 90 indicators of compromise (IOC) associated with Dark Caracal including 11 different Android malware IOCs; 26 desktop malware IOCs across Windows, Mac, and Linux; and 60 domain/IP based IOCs.

I rapporten pekas den libanesiska säkerhetstjänsten ut som sannolik skapare och den som samlar in alla den här informationen.

E-postadresser

I trojaniserade versioner av Adobes Flash Player finns ytterligare tecken som pekar mot Libanon. Bland de e-postadresser som använts finns flera adresser som har använts av libanesiska medborgare.