Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started
Threat Actors Volatile Cedar

Volatile Cedar

G0123 TLP:CLEAR
Active
Kill Chain Analysis Generate Graph Hunt Package

Also known as: Lebanese Cedar, Lebanon, DeftTorero, VolcanicTimber, Volatile Cedar

Description

Volatile Cedar is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. Volatile Cedar has been operating since 2012 and is motivated by political and ideological interests.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)

TTP Summary

The modus operandi for this attacker group initially targets publicly facing web servers, with both automatic and manual vulnerability discovery. Once in control of a server, the attackers further penetrate the targeted internal network via various means, including manual online hacking as well as an automated USB infection mechanism.

Goals & Targeting

Targeted Countries / Regions

US
GB
IL
middle_east
europe

AI Analysis

No AI analysis yet.

ATT&CK Techniques

Observed Data

No observed data linked yet.

Indicators of Compromise

View all →
Domain 10 MD5 Hash 10
Domain 10
cs.applight.mobi
75% TLP:CLEAR
api.jaxfire.mobi
75% TLP:CLEAR
api.applight.mobi
75% TLP:CLEAR
api.superflashlight.mobi
75% TLP:CLEAR
api.shenmeapp.info
75% TLP:CLEAR
cdn.applight.mobi
75% TLP:CLEAR
shenmeapp.info
75% TLP:CLEAR
superflashlight.mobi
75% TLP:CLEAR
applight.mobi
75% TLP:CLEAR
jaxfire.mobi
75% TLP:CLEAR
MD5 Hash 10
5d1f75bfc7cbd96891f26b1041fd5994
50% TLP:CLEAR
b54346cdaf9556eb88f3d95e0bad2be5
50% TLP:CLEAR
e9f0260409c6c964985fa4df926d7e04
50% TLP:CLEAR
3188df195d09ee38d89707501e330c2f
50% TLP:CLEAR
1aebf9d07fe6e82d97e062cdbe656a36
50% TLP:CLEAR
39887492c5c70977c0c0cf0aa0e7154b
50% TLP:CLEAR
a97fdcb6493c2012aeebdeef0e09625a
50% TLP:CLEAR
1316d35f6472eb323ae2c8b75199fbb5
50% TLP:CLEAR
09a0970bfc1bc8acec1ec609d8d98fda
50% TLP:CLEAR
fef76a8027e07c7a51b312a26c488653
50% TLP:CLEAR
Open in full Indicators list →

References

  1. ClearSky Lebanese Cedar Jan 2021 — ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
  2. CheckPoint Volatile Cedar March 2015 — Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.

Intel Summary

5

Techniques

3

Tools

1

Campaigns

40

IOCs

0

Observed Data

4

Tactics

Tags

APT

Details

MITRE ID
G0123
Type
Unknown
Resource Level
Unknown
Primary Motivation
Espionage
Country of Origin
L
Confidence
90%
Added
May 2, 2026
STIX ID
intrusion-set--b2e34388-6938-4c59-a702-80dc219e15e3
Notes
0
Log in to add a note
No notes yet. Click "Add Note" to create the first analysis note.
Opinions
0
Log in to add an opinion
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.