Classic Brechas Mapa Actores TTP Matrix Analitica Alertas CyberNews Arsenal Exploits KillChain Origen SSLBL RansomLook Ransomwhere

Dark Caracal

1 incidentes 1 paises 0 sectores apt LB Ultimo: 2026-05-25

Aliases: ATK 27, TAG-CT3, G0070, APT DARKCARACAL

Ver en IntelTracker → APTTrail →

Dark Caracal is a state-sponsored advanced persistent threat (APT) group believed to operate from within the Lebanese General Directorate of General Security (GDGS), with activity dating back to April 2010. The group's primary motivation is cyber espionage and information theft, having exfiltrated hundreds of gigabytes of data from thousands of victims across over 20 countries. What distinguishes Dark Caracal is its pioneering focus on mobile devices as a primary attack vector, making it one of the first publicly documented mobile APT actors to execute espionage on a global scale. The group has also been observed operating under the aliases ATK 27, TAG-CT3, and G0070.

Aliases del actor

ATK 27 TAG-CT3 G0070 APT DARKCARACAL

Actores similares

apt-darkcaracalactor · 1 apt-darkhydrusactor · 1 apt-45actor · 2 apt-c-27actor · 2 apt-c-01actor · 2 apt-c-12actor · 1 apt-18actor · 1 apt-1877teamactor · 1 apt-27actor · 1 apt-30actor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

Tipo	Estado	Host / enlace	Title / ultimo titulo
Web	unknown	info.lookout.com	APT DARKCARACAL indicators and references
Web	unknown	www.virustotal.com	APT DARKCARACAL indicators and references
Web	unknown	www.virustotal.com	APT DARKCARACAL indicators and references
Repositorio	unknown	github.com	APT DARKCARACAL indicators and references
Web	unknown	raw.githubusercontent.com	APT DARKCARACAL indicators and references
Web	unknown	info.lookout.com	APT DARKCARACAL indicators and references

Motivacion