Volatile Cedar

Volatile Cedar, also referred to as Lebanese Cedar, is a Lebanese threat group reportedly active since 2012 and motivated by political and ideological interests. The group has targeted individuals, companies, and institutions worldwide, with reported intrusions across Lebanon, Israel, Palestine, Egypt, the United States, and the United Kingdom. The content associates Lebanese Cedar with the Lebanese Shiite militant group Hezbollah and notes possible coordination with Iran-nexus actors affiliated with the Ministry of Intelligence and Security (MOIS). Known aliases in the provided content include Amethyst Rain, Lebanese Cedar, Volatile Cedar, and VolcanicTimber. The group has targeted publicly facing web servers, using both automatic and manual vulnerability discovery and performing vulnerability scans of target servers. It has compromised victim web servers through n-day vulnerabilities and deployed web shells including ASPXSpy, devilzshell, and Caterpillar. The content also states that Volatile Cedar can deploy additional tools, has used Meterpreter, and has used a custom malware family called Explosive RAT to maintain access and steal legitimate network credentials for espionage. Techniques directly mentioned in the content include Exploit Public-Facing Application (T1190), Web Shell (T1505.003), IIS Components (T1505.004), Command and Scripting Interpreter (T1059), Ingress Tool Transfer (T1105), Upload Malware (T1608.001), and Upload Tool (T1608.002).