MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-30 02:37:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #535 from ITAYC0HEN/feature/AddDarkUniverseActor

Browse source 
Add ItaDuke/DarkUniverse actor
This commit is contained in:
Alexandre Dulaunoy 2020-04-23 11:22:39 +02:00 committed by GitHub
commit 13348879cc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
clusters/threat-actor.json
View file

@ -8098,6 +8098,22 @@
},
"uuid": "86b4e2f3-8bbf-48fd-9d27-034d3ac3b187",
"value": "VENOM SPIDER"
},
{
"description": "ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by Kaspersky.",
"meta": {
"refs": [
"https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/",
"https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html",
"https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465"
],
"synonyms": [
"DarkUniverse",
"SIG27"
]
},
"uuid": "d0b900fa-84b4-11ea-bc55-0242ac130003",
"value": "ItaDuke"
}
],
"version": 157