Volatile Cedar - G0123

Created: 2021-02-08T20:30:30.578Z

Modified: 2022-04-20T20:08:15.870Z

Contributors:

Aliases

Volatile Cedar,Lebanese Cedar

Description

Volatile Cedar is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. Volatile Cedar has been operating since 2012 and is motivated by political and ideological interests.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1595.003|Wordlist Scanning|Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.(Citation: ClearSky Lebanese Cedar Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|Volatile Cedar can deploy additional tools.(Citation: ClearSky Lebanese Cedar Jan 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.(Citation: CheckPoint Volatile Cedar March 2015) (Citation: ClearSky Lebanese Cedar Jan 2021) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|Volatile Cedar can inject web shell code into a server.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021) |
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|Volatile Cedar has performed vulnerability scans of the target server.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)|