MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2025-01-18 10:36:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[threat-actors] Add UNC2465

Browse source
This commit is contained in:
Mathieu4141 2024-12-20 02:55:34 -08:00
parent 7a12bc29c8
commit 0863ea4794
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
clusters/threat-actor.json
View file

@ -17561,6 +17561,18 @@
},
"uuid": "ceabe862-3d89-4696-9d7f-32a4850334d9",
"value": "Aggressive Inventory Zombies"
},
{
"description": "UNC2465 is a threat actor known for deploying the SMOKEDHAM .NET backdoor and DARKSIDE ransomware, utilizing TTPs such as phishing, Trojanized software installers, and supply chain attacks. They have employed the NGROK utility to expose internal services and facilitate lateral movement within victim environments. UNC2465 has also leveraged tools like UltraVNC, Cobalt Strike BEACON, and conducted credential harvesting via LSASS memory dumping. Their operations have included extortion tactics through a leaks website over TOR, applying pressure on victims by releasing stolen data.",
"meta": {
"refs": [
"https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations",
"https://cloud.google.com/blog/topics/threat-intelligence/darkside-affiliate-supply-chain-software-compromise",
"https://cloud.google.com/blog/topics/threat-intelligence/burrowing-your-way-into-vpns"
]
},
"uuid": "cbdf8d63-c114-47d5-8f32-f87f365c7c43",
"value": "UNC2465"
}
],
"version": 321