Cybersecurity & Privacy From The Global Lens
summary
EFF Threat Lab documents a campaign called Dark Caracal that uses phishing and sideloaded Android trojans masquerading as Signal WhatsApp Psiphon and fake Play Stores, plus Windows malware like Bandook and CrossRAT, with no zero days needed. Investigators pull 250,000 files, ~500,000 texts, 1,500 authentication accounts and ~200,000 unique Wi‑Fi SSIDs from exposed C2 servers fingerprinted as Windows/XAMPP/Apache/MariaDB. Targets cluster in the Middle East and a test SSID maps to building 3 floor 6 (Lebanon General Security); likely a third‑party surveillance portal sold to states.
AI-written summary · about
chapters (16)
- 0:00Introduction to EFF work
- 2:01Advocacy and legal efforts
- 3:21Surveillance and export laws
- 7:51Technology project initiatives
- 8:30Targeted digital surveillance
- 12:12Project Dark Caracal
- 13:36Uncovering operation manual
- 15:32Malware capabilities
- 18:34Attack vectors analysis
- 21:24Low-sophistication tactics
- 23:28Desktop and cross-platform
- 27:13Data exfiltration findings
- 30:41Infrastructure and attribution
- 33:57Locating the source
- 36:54Ethics and cybersecurity
- 50:54Encryption and conclusion
related talks
26mTracking the World's Dumbest Cyber Mercenaries
26mThe Secret Life of Sandworms
26mUnder the SEA - A Look at the Syrian Electronic Army's Mobile Tooling
40mThe Canary in the Coalmine of Cybersecurity: Fraud as a Warning Sign
32mUsing Geopolitical Conflicts for Threat Hunting
45mThe Discovery of a Government Malware and an Unexpected Spy Scandal
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
30mReversing Mobile Malware