[threat-actors] Add BrazenBamboo

clusters/threat-actor.json

@@ -17443,6 +17443,17 @@
       },
       "uuid": "4d3c9666-6e08-4186-854c-cc0f8c28f5b6",
       "value": "Kairos"
+    },
+    {
+      "description": "BrazenBamboo is a Chinese state-affiliated threat actor known for developing the LIGHTSPY, DEEPDATA, and DEEPPOST malware families. Their infrastructure includes capabilities for zero-day exploitation, specifically targeting vulnerabilities like FortiClient, and employs a command-and-control architecture that supports multi-platform operations. Volexity's analysis indicates that BrazenBamboo is a well-resourced entity with a focus on domestic targets, utilizing custom analyst software to manage data collected from their malware. The ongoing development of their malware families is evidenced by the timestamps associated with their latest payloads.",
+      "meta": {
+        "country": "CN",
+        "refs": [
+          "https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/"
+        ]
+      },
+      "uuid": "305fbff0-d3ff-43e3-8741-63bad68e47ee",
+      "value": "BrazenBamboo"
     }
   ],
   "version": 320