Dark Caracal is a

spyware Spyware (a portmanteau for spying software) is software with malicious behaviour that aims to gather information about a person or organization and send it to another entity in a way that harms the user—for example, by violating their privac ...

campaign that has been conducted by an unknown group of hackers since at least 2012. The campaign was discovered by the

Electronic Frontier Foundation The Electronic Frontier Foundation (EFF) is an international non-profit digital rights group based in San Francisco, California. The foundation was formed on 10 July 1990 by John Gilmore, John Perry Barlow and Mitch Kapor to promote Internet ci ...

and the mobile security firm

Lookout A lookout or look-out is a person in charge of the observation of hazards. The term originally comes from a naval background, where lookouts would watch for other ships, land, and various dangers. The term has now passed into wider parlance. ...

, who published their findings on January 18, 2018. The campaign has mainly used phishing attacks (and in some cases physical access to victims systems) in order to install malicious Android applications, including ones that imitate the look and feel of popular

instant messaging Instant messaging (IM) technology is a type of online chat allowing real-time text transmission over the Internet or another computer network. Messages are typically transmitted between two or more parties, when each user inputs text and trigge ...

applications, on victims systems to gain full control over the devices. No evidence was found that iPhone users have been targeted, and according to

Google Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. ...

, none of the malicious applications were found on the

Google Play Store Google Play, also known as the Google Play Store and formerly the Android Market, is a digital distribution service operated and developed by Google. It serves as the official app store for certified devices running on the Android operating sys ...

. The data allegedly stolen includes documents, call records, text messages, audio recordings, secure messaging client content, browsing history, contact information, photos, location data, and other information that allows the group to identify their targets and have a look at their personal lives. The component used to monitor Android devices is known as Pallas; the component used to monitor

Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...

devices is a variant of the Bandook trojan. The campaign is suspected to be state-sponsored and linked to the Lebanese government's

General Directorate of General Security The General Security Directorate ( ar, الامن العام, al-Amn al-'Aam; french: La Sûreté Générale) is a Lebanese intelligence agency founded on July 21, 1921 and originally known as the "first bureau". On June 12, 1959, Decree-Law No. ...

. According to ''Reuters'', "the researchers found technical evidence linking servers used to control the attacks to a GDGS office in Beirut by locating wi-fi networks and internet protocol address in or near the building." The researchers have said that they are not certain "whether the evidence proves GDGS is responsible or is the work of a rogue employee." The report was denied by Major General Abbas Ibrahim.

References

External links

"Dark Caracal; Cyber-espionage at a Global Scale"
technical report by Lookout and the Electronic Frontier Foundation Spyware {{Espionage-stub