Dark Caracal
5
linked CVEs
Also known as
G0070
Targeted industries
Telecommunications
Targeted regions
BrazilChileColombiaEcuadorEl SalvadorUruguayVenezuela, Bolivarian Republic of
Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of writing is believed to be administered out of a building belonging to the Lebanese General Security Directorate in Beirut. At present, we have knowledge of hundreds of gigabytes of exfiltrated data, in 21+ countries, across thousands of victims. Stolen data includes enterprise intellectual property and personally identifiable information.
Source: misp_galaxy · Collected: 2026-09-19
⚡ Vulnerabilities & Exploits5 CVEs
threat_actor_cve → cves / exploits.cve_ids
| CVE-2026-28323 suspected | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled. | CVSS 9.8 |
| CVE-2026-28299 suspected | SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory. | CVSS 8.2 |
| CVE-2026-18577 suspected | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | CVSS 8.1 KEV |
| CVE-2026-50656 suspected | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". | CVSS 7.8 |
| CVE-2026-18556 suspected | Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1. | CVSS 7.4 KEV |
🔍 Detection Coverage0 Sigma
Derived from linked CVEs — not a direct actor match
No Sigma rules mapped via this actor's CVEs yet.
🧬 YaraComing soon
MITRE ATT&CK Techniques Used12 techniques
Across 8 tactics
Collection2 techniques
T1005Data from Local System
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to…
T1113Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access too…
Command And Control1 technique
Execution2 techniques
T1059.003Windows Command Shell
Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows…
T1204.002Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This us…
Initial Access2 techniques
T1189Drive-by Compromise
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., [Drive-by Target](https…
T1566.003Spearphishing via Service
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different f…
Privilege Escalation1 technique
Stealth3 techniques
T1027.002Software Packing
Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable ch…
T1027.013Encrypted/Encoded File
Adversaries may encrypt or encode files to obfuscate strings, bytes, and other specific patterns to impede detection. Encrypting and/or encoding file content aims to conceal malicious artifacts within…
T1218.001Compiled HTML File
Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of vario…
🛰️ Infrastructure & IOCs39
| domain | documentodigital.cloud | — | 2026-08-26 |
| domain | getpdfdigital.cloud | — | 2026-08-26 |
| ip | 77.110.105.244 | — | 2026-08-26 |
| ip | 82.117.87.138 | — | 2026-08-26 |
| ip | 82.117.87.192 | — | 2026-08-26 |
| sha256 | 8c03d072df2e1bf14b0c00a8ab99834138c8b69f301849bf09cb44394e916015 | — | 2026-08-26 |
| domain | visualizarpdf.online | — | 2026-08-26 |
| ip | 193.233.245.52 | — | 2026-08-26 |
| md5 | 27cc65cb6261ef0d584287cf09bdafcc | — | 2026-08-26 |
| domain | contabilidad.icu | — | 2026-08-26 |
| ip | 185.125.101.181 | — | 2026-08-26 |
| ip | 109.172.95.121 | — | 2026-08-26 |
| sha256 | 77f7ad29f4a8037ee5f38d3d87fb91cfd97cb8f7fa7883edf3fce506df5200c0 | — | 2026-08-26 |
| ip | 77.110.98.66 | — | 2026-08-26 |
| ip | 185.96.80.110 | — | 2026-08-26 |
| ip | 77.110.104.98 | — | 2026-08-26 |
| ip | 109.120.187.217 | — | 2026-08-26 |
| sha1 | 40d99e70de5918c6cad144dfc1ad4acd806aca3b | — | 2026-08-26 |
| ip | 176.124.220.153 | — | 2026-08-26 |
| sha1 | 9f2be216c5df190806e621e970c9f3e106048441 | — | 2026-08-26 |
| ip | 77.110.105.59 | — | 2026-08-26 |
| sha256 | a2cdf2fe741de4b13ad2298b387a6c32da4a94da180ae75bf8547386aee7376b | — | 2026-08-26 |
| ip | 185.96.80.54 | — | 2026-08-26 |
| ip | 46.226.162.68 | — | 2026-08-26 |
| ip | 85.192.30.211 | — | 2026-08-26 |
| ip | 62.60.237.22 | — | 2026-08-26 |
| domain | gestionadocs.me | — | 2026-08-26 |
| sha256 | 1e499c815146124c4a6d2b48c99068b980ad74e1a2cfd16013f8d75a9425a0ca | — | 2026-08-26 |
| ip | 80.71.224.30 | — | 2026-08-26 |
| sha256 | c9da1b08a39491dfdbede6ff4c1a2d383f57cb29e2d3532aee08d6e0a5c1dda6 | — | 2026-08-26 |
| ip | 138.124.14.130 | — | 2026-08-26 |
| ip | 193.233.245.45 | — | 2026-08-26 |
| ip | 138.124.112.213 | — | 2026-08-26 |
| domain | soportedigital.cloud | — | 2026-08-26 |
| ip | 45.152.198.108 | — | 2026-08-26 |
| ip | 77.110.105.56 | — | 2026-08-26 |
| ip | 79.137.192.38 | — | 2026-08-26 |
| domain | getpdf.digital | — | 2026-08-26 |
| sha256 | 0a6da70548f14834acb8960689a589b48ff422f8385ae445a281aab77045fe22 | — | 2026-08-26 |
📰 Threat Intel Coverage0
Digest reports mentioning this actor (incl. aliases)
No threat intel digest coverage found.