Volatile Cedar
Also known as Lebanese Cedar, DeftTorero
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1105 Ingress Tool TransferT1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1595.002 Vulnerability ScanningT1595.003 Wordlist Scanning
Recent activity
No posts or advisories have named this actor recently.
References
- https://blog.checkpoint.com/2015/03/31/volatilecedar/
- https://blog.checkpoint.com/2015/06/09/new-data-volatile-cedar/
- https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/
- https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf
- https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/
- https://attack.mitre.org/groups/G0123
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.