Tracking the World's Dumbest Cyber Mercenaries

Tracking the World's Dumbest Cyber Mercenaries

Speakers: Cooper Quintin, Eva Galperin

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=aW-Wyiae1lY

Reading time: 8 minutes

TL;DR

EFF researchers Cooper Quintin and Eva Galperin have spent nearly a decade tracking Dark Caracal — a cyber mercenary operation linked to Lebanon's General Directorate of General Security that managed to be both surprisingly effective and spectacularly incompetent. The case study is a masterclass in how open command-and-control servers, sloppy operational security, and a willingness to register malware infrastructure under real names can give defenders extraordinary access to an adversary's entire campaign.

Introduction

Not all dragons breathe the same fire. The cyber mercenary landscape runs from NSO Group and Paragon Solutions — vendors of sophisticated zero-click exploits sold to nation-states — down to operators so poorly disciplined that researchers can download their entire stolen data trove from a misconfigured Apache directory listing. Dark Caracal lives at the far end of that spectrum.

Cooper Quintin, senior staff technologist at the Electronic Frontier Foundation, and Eva Galperin, EFF's director of cybersecurity, presented a decade-long investigation into this threat actor at BSidesSF 2025. The talk covers Operation Manul (2016), Dark Caracal (2017), and a 2022 resurgence — each installment revealing new dimensions of a campaign that has managed to compromise targets across at least 20 countries while leaving its command-and-control infrastructure wide open to anyone who knew to look.

The story is equal parts technical analysis and cautionary tale. As Galperin put it in closing: "You don't have to deploy zero-click mobile malware to be effective. There be dragons, and even this kind of idiot dragon is still a dragon and it can still breathe fire."

The Target: Irina Petrushova and Kazakhstan's Independent Press

▶ Watch: Background on the original target (03:00)

The story begins in the 1990s with Irina Petrushova, a journalist and activist who founded one of Kazakhstan's only independent newspapers. The publication was unwelcome to President Nursultan Nazarbayev's government, and the reprisals were severe: a skull left at the printer's doorstep, a severed dog's head outside Petrushova's home, the burning of her office, threats against her son. In 2002, Petrushova and her family fled Kazakhstan for Russia — with the observation that Russia felt safer, which tells you something about the conditions she was leaving.

The paper eventually moved online (2007), and by 2014 a leaked document hosting site called Kazaword was publishing emails from inside the Nazarbayev administration. Kazakhstan sued in New York federal court to enjoin the site's US-based web host. Around the same time, the publication's team — including Petrushova's son and their attorney — began receiving spear-phishing emails. The EFF became their legal counsel, and Quintin and Galperin got their first look at the malware.

Operation Manul: An Open XAMPP Server and a Novel Windows RAT

▶ Watch: Bandook malware and Operation Manul (08:30)

The phishing emails impersonated a lawyer named Eric Rushett and claimed to contain a legal invoice on behalf of a Kazak dissident and theater director. The PDF attachment displayed a blurry document with an error message; clicking the error installed Bandook, a Windows remote access tool. Standard RAT capabilities: shell access, webcam and microphone monitoring, system file manipulation, download of second-stage infections, and — notably — collection of nearby Wi-Fi access points.

What distinguished this case was what Quintin found on the command-and-control server. The attackers were running XAMPP (a Windows-based Apache/MySQL/PHP stack), and had left directory indexing enabled by default. With no index.html file present, any visitor could browse all files in the web root. The attackers had also been uploading exfiltrated files from victim machines directly into that same web-accessible directory.

Quintin ran DirBuster against the directories, downloaded everything, and found: dozens of additional campaign targets, what appeared to be data from a Vietnamese cigarette company (reasons unknown), complete Windows machine backups, web login forms for the C2 panel, and files extracted from mobile devices. The last item suggested a mobile component nobody had looked for yet.

The 2016/2017 Operation Manul paper documented these findings. Shortly after publication, researchers from Lookout — Michael Flossman, Mike Murray, and Andrew Blake — came to EFF with a hypothesis: they believed they had found the mobile counterpart.

Dark Caracal: 81 Gigabytes from Open C2 Servers

▶ Watch: Dark Caracal mobile malware campaign (16:00)

The mobile malware, which EFF and Lookout named Palace (after a cat native to Syria), was distributed as backdoored versions of legitimate applications: Signal, WhatsApp, Orbot, Siphon, and dozens of others. All had been repackaged with spyware that captured photos, GPS coordinates, text messages, call logs, nearby Wi-Fi access points, and the plaintext of encrypted messages.

The C2 infrastructure was still running XAMPP with directory indexes open. The team downloaded mobile and desktop exfiltrated data totaling 81 gigabytes — the majority from mobile infections. The scale was significant for a campaign that used no exploits whatsoever: every infection was obtained through social engineering, either via email (like the Bandook campaigns) or via messages saying "install this app so we can communicate more securely" and sending the malicious APK directly.

XAMPP revealed a second gift: Apache Status, a module enabled by default in the version they were running, which publishes a real-time log of everyone visiting the server — including IP addresses. That included both infected victim machines and the people logging into the C2 web admin panel. Those admin logins were consistently geolocating to Beirut, Lebanon — specifically to downtown Beirut.

Geolocation of the earliest test infections, combined with analysis of a Wi-Fi network name (BLD3F6 — Building 3, Floor 6) that appeared in the test device data, allowed the team to physically identify the building. An EFF contact traveled to Beirut with an Android device looking for that Wi-Fi network and confirmed its location: the headquarters of Lebanon's General Directorate of General Security (GDGS). The GDGS denied involvement, then said that if they had done it, it was legal. They also accused EFF of working for the CIA and/or Mossad. Galperin described that as a very busy schedule.

The 2022 Resurgence: A Sinkhole and a Career Arc

▶ Watch: New Bandook sample and sinkhole operation (26:30)

The story did not end with the Dark Caracal paper. In 2022, Quintin found a new Bandook sample on VirusTotal with updated features. The sample contained two domains: a C2 domain (now running properly secured infrastructure — the operators had read the earlier reports) and a secondary plugin-download domain called uncleso.com.

The secondary domain had not been registered. Quintin registered it — "a move I call the Marcus Hutchins" — set up a sinkhole, and began logging traffic. Between 700 and 800 machines connected every weekday, dropping to 100–300 on weekends, roughly during business hours. The pattern suggested corporate machines not in use on weekends. The infections were concentrated in the Dominican Republic, with smaller clusters in the US, Canada, the UK, Chile, Spain, and Venezuela.

The connection to the Dominican Republic remained unexplained until approximately a month later, when a Darknet Diaries episode noted that the Bandook malware was being used to deploy Conti ransomware — a ransomware gang known for maintaining tight control over their toolset. Whether the Bandook operator (tracked under the handle "Prince Ali" and long believed to work at GDGS by day) had partnered with Conti, been hired by them, or gone independent after GDGS stopped paying the bills was unclear. Hacking Team had previously rejected his job application, describing him as a "scrub" in leaked emails — so the career trajectory has been uneven.

EFF awarded Dark Caracal the "Dunce Cap" for their operational security record, while acknowledging that despite all the mistakes, they have remained active and effective for the better part of a decade.

The Broader Context: Why Bad OpSec Still Works

▶ Watch: Conclusions on the cyber mercenary landscape (33:00)

Quintin and Galperin closed with observations about the expanding cyber mercenary ecosystem. The number of such actors is growing, and they span a wide spectrum of sophistication. A significant driver of that growth is the success of encryption: end-to-end encrypted communications are now ubiquitous globally (WhatsApp being the most prevalent example), which means that governments and criminal actors who want device contents are increasingly forced to deploy malware rather than intercepting traffic.

Apple's Lockdown Mode was highlighted as one of the most effective defenses to date: it has blocked every known government-sponsored attack in field conditions. Both Apple and Google have published reports on campaigns carried out by NSO Group and Paragon Solutions — including zero-click zero-day exploits — that failed against iPhones running Lockdown Mode. Galperin cautioned against declaring the encryption fight won, but noted that the center of gravity for surveillance and access has shifted to endpoint compromise.

The takeaway for the community: don't benchmark only against Pegasus. Dark Caracal has infected hundreds of victims across 20 countries using no exploits, open XAMPP servers, and APKs sent over messaging apps. The threat doesn't require sophistication to be real.

Notable Quotes

"You don't have to deploy zero-click mobile malware to be effective. There be dragons, and even this kind of idiot dragon is still a dragon and it can still breathe fire."

"The only pictures coming from these infections were up-the-nose shots of someone in their office and it only ever connected to a single Wi-Fi network. And that network was called BLD3F6, Building 3 Floor 6. It's a goddamn mystery."

"Hacking Team said, 'This guy's a scrub. We're not going to hire this guy. He sucks. Don't even respond to him.' So, you know, he's been trying to do this for a long time, and he's finally made a career out of it."

Key Takeaways

• Default configurations kill. XAMPP's open directory indexes and the Apache Status module gave EFF 81 gigabytes of exfiltrated victim data and the IP addresses of the operators. Default-deny for directory listing is not optional.
• Sinkholing unregistered domains is a powerful research technique. Registering the secondary C2 domain before the operator did gave EFF months of infection telemetry without deploying a single sensor.
• Physical tradecraft can complete digital investigations. Geolocation of Wi-Fi data from infected test devices, combined with on-the-ground reconnaissance in Beirut, allowed attribution to a specific building — a technique that would be difficult to replicate remotely.
• Social engineering outperforms exploits for many threat actors. Dark Caracal achieved 81 GB of exfiltrated mobile data with no exploits — only phishing emails and repackaged APKs delivered over chat.
• The cyber mercenary market is not uniformly sophisticated. Not every threat actor is NSO Group. Low-capability actors can still achieve significant reach, and defending against them requires attending to basic hygiene rather than only advanced threat modeling.