From 169d69871a08d37db5caab39b16dd676f63e57a3 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Wed, 12 Dec 2018 13:52:55 +0100
Subject: [PATCH] add Goden Chickens and affiliates

---
 clusters/exploit-kit.json  |  7 ++++--
 clusters/threat-actor.json | 48 ++++++++++++++++++++++++++++++++++++++
 clusters/tool.json         | 30 ++++++++++++++++++++++++
 3 files changed, 83 insertions(+), 2 deletions(-)

diff --git a/clusters/exploit-kit.json b/clusters/exploit-kit.json
index 3061344..4d5d08c 100644
--- a/clusters/exploit-kit.json
+++ b/clusters/exploit-kit.json
@@ -191,9 +191,12 @@
       "description": "VenomKit is the name given to a kit sold since april 2017 as \"Word 1day exploit builder\" by user badbullzvenom. Author allows only use in targeted campaign. Is used for instance by the \"Cobalt Gang\"",
       "meta": {
         "refs": [
-          ""
+          "https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648"
         ],
-        "status": "Active"
+        "status": "Active",
+        "synonyms": [
+          "Venom"
+        ]
       },
       "uuid": "b8be7af8-69a8-11e8-adc0-fa7ae01bbebc",
       "value": "VenomKit"
diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index bd39186..127815a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -6060,6 +6060,54 @@
       },
       "uuid": "08ff3cb6-c292-4360-a978-6f05775881ed",
       "value": "Operation Poison Needles"
+    },
+    {
+      "description": "From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).",
+      "meta": {
+        "refs": [
+          "https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648"
+        ],
+        "synonyms": [
+          "Golden Chickens",
+          "Golden Chickens01",
+          "Golden Chickens 01"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "6d50a8a2-fdf5-11e8-9db3-833f231caac8",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ],
+      "uuid": "6bd7c91a-fdf5-11e8-95a8-e712ad4b0a9d",
+      "value": "GC01"
+    },
+    {
+      "description": "From November 2017 to October 2018, we attributed 14 campaigns to the GC threat actors that used a specific MaaS provider (hereinafter “the Provider”) offered by a known individual (hereinafter “the Provider Operator”).",
+      "meta": {
+        "refs": [
+          "https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648"
+        ],
+        "synonyms": [
+          "Golden Chickens",
+          "Golden Chickens02",
+          "Golden Chickens 02"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "6bd7c91a-fdf5-11e8-95a8-e712ad4b0a9d",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ],
+      "uuid": "6d50a8a2-fdf5-11e8-9db3-833f231caac8",
+      "value": "GC02"
     }
   ],
   "version": 82
diff --git a/clusters/tool.json b/clusters/tool.json
index afc3b36..09f9ee2 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -7443,6 +7443,36 @@
       },
       "uuid": "a9467439-48d8-4f68-9519-560bb6430f0c",
       "value": "KingMiner"
+    },
+    {
+      "description": "Toolkit - building kit for crafting documents used to deliver attacks",
+      "meta": {
+        "refs": [
+          "https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648"
+        ]
+      },
+      "uuid": "a315f2be-0cd7-4a2b-876d-d6a772de9dca",
+      "value": "Taurus"
+    },
+    {
+      "meta": {
+        "refs": [
+          "https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648"
+        ]
+      },
+      "uuid": "dbbc8e91-a6c4-441f-8424-6bc096edf944",
+      "value": "Terra Loader"
+    },
+    {
+      "description": "In 2018, CTU researchers observed several GOLD KINGSWOOD campaigns involving SpicyOmelette, a tool used by the group during initial exploitation of an organization. This sophisticated JavaScript remote access tool is generally delivered via phishing, and it uses multiple defense evasion techniques to hinder prevention and detection activities. GOLD KINGSWOOD delivered SpicyOmelette through a phishing email containing a shortened link that appeared to be a PDF document attachment. When clicked, the link used the Google AppEngine to redirect the system to a GOLD KINGSWOOD-controlled Amazon Web Services (AWS) URL that installed a signed JavaScript file, which was SpicyOmelette.",
+      "meta": {
+        "refs": [
+          "https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648",
+          "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
+        ]
+      },
+      "uuid": "48753e22-6c22-409c-b274-68f822c7ef57",
+      "value": "SpicyOmelette"
     }
   ],
   "version": 104