Dark Caracal

Dark Caracal is a threat actor associated in the provided content with cyber espionage activity. The content states that it conducted cyber espionage in Latin America and the Caribbean and delivered Poco RAT through financial-themed phishing. Dark Caracal has used malicious Microsoft Word documents with macros that download a second stage when executed, and is also listed in association with UDL-file-based spearphishing attachment activity. The group is described as making malware appear to be Flash Player, Microsoft Office, or PDF documents to entice user execution. For execution and command activity, the content associates Dark Caracal with Windows Command Shell activity and standard HTTP-based implant control. The content also states that a Dark Caracal Bandook variant communicates over a TCP port using Base64-encoded HTTP payloads suffixed with the string "&&&", and that strings in this Bandook variant were obfuscated by Base64 encoding and then encryption. For persistence, the content states that Dark Caracal's Bandook variant adds a registry key under HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run. For collection, the content states that Dark Caracal collected the complete contents of the Pictures folder from compromised Windows systems. The only alias directly provided in the content is dark_caracal.