Hackers linked to Lebanese government caught in global cyber

The General Directorate of General Security, a Lebanese intelligence agency, has been tied to a mobile hacking operation discovered by researchers with cybersecurity firm Lookout Mobile Security and digital rights group Electronic Frontier Foundation (EFF).

The General Directorate of General Security, a Lebanese intelligence agency, has been tied to a mobile hacking operation discovered by researchers with cybersecurity firm Lookout Mobile Security and digital rights group Electronic Frontier Foundation (EFF).

Lookout and EFF are calling the hacking campaign “Dark Caracal,” in reference to a wild cat native to Africa and the Middle East. The organizations discovered that hackers are using malicious smartphone applications and websites to steal passwords and eavesdrop on conversations. The discoveries were revealed Thursday in a 49-page report.

The Dark Caracal hackers reportedly used several different email phishing strategies to lace familiar applications and websites, like Twitter, Facebook and WhatsApp, with malware. They also used fake login pages to acquire personal information. Some victims could have even been hacked by clicking on booby- trapped messages and lures that led them to fake social media profiles of young Lebanese women, according to Lookout. 

Michael Flossman, security research services lead at Lookout, said that victims who had devices infected by the Android malware, granted hackers access to remotely everything on their device.

The hackers reportedly captured at least 486 thousand text messages from victims in over 21 different countries, including the U.S.. EFF and Lookout came across the cyber-espionage campaign during a separate investigation focused on Kazakh journalists and lawyers. Because of the group’s apparent prior success, it was hard for Flossman to believe the skilled group of spies could slip up accidentally.

EFF Director of Cybersecurity Eva Galperin told the Associated Press that the discovery was remarkable since they were able to acquire so many clues about the spies. The hackers incidentally left digital artifacts in their attacks, which could ultimately be traced back to their exact location.

“We definitely considered throughout the investigation that this was a honeypot, but we came to the conclusion that this this was actually poor operational security, not intentional,” Flossman said.

Researchers with Lookout say the Lebanese hackers were traced back to an active WiFi network neighboring a building that houses the Lebanese security agency. The WiFi network was still active when an Associated Press journalist went near the location to test and confirm the theory.

Although researchers were unable to identify the true identities of the hackers, they discovered three aliases associated with email addresses that were instrumental to the attacker’s server infrastructure.

Even though the General Directorate of General Security declined to comment, the authorities have been notified. Lookout and EFF said they will continue to search for further evidence of Dark Caracal.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure