🇱🇧

Volatile Cedar

APT Group Information theft and espionage ETDA ✓

Also Known As 2 names

DeftTorero Lebanese Cedar

Target Countries 9

Countries highlighted in red

Canada Egypt United Kingdom Israel Islamic Republic of Iran Jordan Lebanon Saudi Arabia United States

Sectors Targeted

Utilities 22 Hosting Education Government Oil and Gas Extraction 211 Internet Publishing and Broadcasting and Web Search Portals 51913

Details

Origin 🇱🇧 LB

Last Updated 01 Jun 2022

Malware Families 1

explosive_rat

MITRE ATT&CK 16

T1003 T1021 T1036 T1046 T1059 T1059.001 T1071.001 T1078.002 T1105 T1190 T1490 T1505 T1505.003 T1595 T1595.002 T1595.003

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 6 entries

Volatile Cedar Check Point

Dancing Salome Kaspersky

DeftTorero Kaspersky

VolcanicTimber ?

Amethyst Rain Microsoft

G0123 MITRE

Observed Target Countries 11

Based on ETDA data — countries highlighted in red

Canada Egypt Israel Jordan Lebanon Russia Saudi Arabia UAE UK USA Palestinian Authority

Description

(Check Point) Beginning in late 2012, the carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive. This report provides an extended technical analysis of Volatile Cedar and the Explosive malware. We have seen clear evidence that Volatile Cedar has been active for almost 3 years. While many of the technical aspects of the threat are not considered “cutting edge”, the campaign has been continually and successfully operational throughout this entire timeline, evading detection by the majority of AV products. This success is due to a well-planned and carefully managed operation that constantly monitors its victims’ actions and rapidly responds to detection incidents.

Tools Used 9

Adminer ASPXSpy Caterpillar DirBuster Explosive GoBuster JuicyPotato RottenPotato SharPyShell

Operations 2

2015-06 After going public with our findings, we were provided with a new configuration belonging to a newly discovered sample we have never seen before. https://blog.checkpoint.com/2015/06/09/new-data-volatile-cedar/

2020 Early In early 2020, suspicious network activities and hacking tools were found in a range of companies. https://www.clearskysec.com/cedar/

Reports & References 3

https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/ https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/

ETDA Profile

Volatile Cedar

Origin

Lebanon

First Seen 2012

Sponsor State-sponsored, Hezbollah

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0123/

View on ETDA APT Groups ↗