MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[threat-actors] hormonize reference field

Browse source
This commit is contained in:
Mathieu Beligon 2023-12-05 14:32:26 -08:00
parent b0ebc02b19
commit 287a8d49cb
1 changed files with 22 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
clusters/threat-actor.json
View file

@ -11306,7 +11306,7 @@
}, },
{ {
"meta": { "meta": {
"references": [ "refs": [
"https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618", "https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618",
"https://vixra.org/abs/1902.0257", "https://vixra.org/abs/1902.0257",
"https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/", "https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/",
@ -11340,7 +11340,7 @@
"description": "One of the most active Qbot malware affiliates, Proofpoint has tracked the large cybercrime threat actor TA570 since 2018.", "description": "One of the most active Qbot malware affiliates, Proofpoint has tracked the large cybercrime threat actor TA570 since 2018.",
"meta": { "meta": {
"country": "RU", "country": "RU",
"references": [ "refs": [
"https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware", "https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware",
"https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/", "https://therecord.media/hackers-using-follina-windows-zero-day-to-spread-qbot-malware/",
"https://isc.sans.edu/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt/28728", "https://isc.sans.edu/diary/TA570+Qakbot+Qbot+tries+CVE202230190+Follina+exploit+msmsdt/28728",
@ -11372,7 +11372,7 @@
{ {
"description": "TA575 is a Dridex affiliate tracked by Proofpoint since late 2020. This group distributes malware such as Dridex, Qakbot, and WastedLocker via malicious URLs, Office attachments, and password-protected files. On average, TA575 distributes almost 4,000 messages per campaign impacting hundreds of organizations.", "description": "TA575 is a Dridex affiliate tracked by Proofpoint since late 2020. This group distributes malware such as Dridex, Qakbot, and WastedLocker via malicious URLs, Office attachments, and password-protected files. On average, TA575 distributes almost 4,000 messages per campaign impacting hundreds of organizations.",
"meta": { "meta": {
"references": [ "refs": [
"https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware", "https://blogs.blackberry.com/en/2021/08/blackberry-prevents-threat-actor-group-ta575-and-dridex-malware",
"https://www.proofpoint.com/us/blog/threat-insight/ta575-uses-squid-game-lures-distribute-dridex-malware", "https://www.proofpoint.com/us/blog/threat-insight/ta575-uses-squid-game-lures-distribute-dridex-malware",
"https://www.zdnet.com/article/ta575-criminal-group-using-squid-game-lures-for-dridex-malware/", "https://www.zdnet.com/article/ta575-criminal-group-using-squid-game-lures-for-dridex-malware/",
@ -11430,7 +11430,7 @@
"description": "TA577 is a prolific cybercrime threat actor tracked by Proofpoint since mid-2020. This actor conducts broad targeting across various industries and geographies, and Proofpoint has observed TA577 deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike.", "description": "TA577 is a prolific cybercrime threat actor tracked by Proofpoint since mid-2020. This actor conducts broad targeting across various industries and geographies, and Proofpoint has observed TA577 deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike.",
"meta": { "meta": {
"country": "RU", "country": "RU",
"references": [ "refs": [
"https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware", "https://www.proofpoint.com/us/blog/threat-insight/first-step-initial-access-leads-ransomware",
"https://thehackernews.com/2021/06/ransomware-attackers-partnering-with.html", "https://thehackernews.com/2021/06/ransomware-attackers-partnering-with.html",
"https://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network", "https://www.itpro.com/security/ransomware/359919/ransomware-criminals-look-to-other-hackers-to-provide-them-with-network",
@ -11498,7 +11498,7 @@
"description": "TA2536, which has been active since at least 2015, is likely Nigerian based on its unique linguistic style, tactics and tools. It uses keyloggers such as HawkEye and distinctive stylometric features in typo-squatted domains that resemble legitimate names and the use of recurring names and substrings in email addresses.", "description": "TA2536, which has been active since at least 2015, is likely Nigerian based on its unique linguistic style, tactics and tools. It uses keyloggers such as HawkEye and distinctive stylometric features in typo-squatted domains that resemble legitimate names and the use of recurring names and substrings in email addresses.",
"meta": { "meta": {
"country": "NG", "country": "NG",
"references": [ "refs": [
"https://www.proofpoint.com/us/blog/threat-insight/dtpacker-net-packer-curious-password-1" "https://www.proofpoint.com/us/blog/threat-insight/dtpacker-net-packer-curious-password-1"
] ]
}, },
@ -11558,7 +11558,7 @@
"European Union" "European Union"
], ],
"country": "CN", "country": "CN",
"references": [ "refs": [
"https://twitter.com/MsftSecIntel/status/1625181255754039318" "https://twitter.com/MsftSecIntel/status/1625181255754039318"
] ]
}, },
@ -11586,7 +11586,7 @@
"NGOs" "NGOs"
], ],
"country": "KR", "country": "KR",
"references": [ "refs": [
"https://www.proofpoint.com/us/blog/threat-insight/triple-threat-north-korea-aligned-ta406-scams-spies-and-steals" "https://www.proofpoint.com/us/blog/threat-insight/triple-threat-north-korea-aligned-ta406-scams-spies-and-steals"
] ]
}, },
@ -11623,7 +11623,7 @@
"Pharmaceuticals" "Pharmaceuticals"
], ],
"country": "IR", "country": "IR",
"references": [ "refs": [
"https://www.mandiant.com/resources/blog/apt42-charms-cons-compromises" "https://www.mandiant.com/resources/blog/apt42-charms-cons-compromises"
], ],
"synonyms": [ "synonyms": [
@ -11653,7 +11653,7 @@
"description": "TA453 has employed the use of compromised accounts, malware, and confrontational lures to go after targets with a range of backgrounds from medical researchers to realtors to travel agencies.", "description": "TA453 has employed the use of compromised accounts, malware, and confrontational lures to go after targets with a range of backgrounds from medical researchers to realtors to travel agencies.",
"meta": { "meta": {
"country": "IR", "country": "IR",
"references": [ "refs": [
"https://www.proofpoint.com/us/blog/threat-insight/ta453-refuses-be-bound-expectations", "https://www.proofpoint.com/us/blog/threat-insight/ta453-refuses-be-bound-expectations",
"https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential" "https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential"
] ]
@ -11699,7 +11699,7 @@
"Aviation", "Aviation",
"Energy" "Energy"
], ],
"references": [ "refs": [
"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/" "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/new-apt-group-chamelgang/"
] ]
}, },
@ -11732,7 +11732,7 @@
"United States" "United States"
], ],
"cfr-type-of-incident": "Extortion", "cfr-type-of-incident": "Extortion",
"references": [ "refs": [
"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-152a", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-152a",
"https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group", "https://www.advintel.io/post/enter-karakurt-data-extortion-arm-of-prolific-ransomware-group",
"https://www.accenture.com/us-en/blogs/cyber-defense/karakurt-threat-mitigation" "https://www.accenture.com/us-en/blogs/cyber-defense/karakurt-threat-mitigation"
@ -11771,7 +11771,7 @@
"description": "Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confidence that DEV-0270 conducts malicious network operations, including widespread vulnerability scanning, on behalf of the government of Iran.", "description": "Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also known as Nemesis Kitten, a sub-group of Iranian actor PHOSPHORUS. Microsoft assesses with moderate confidence that DEV-0270 conducts malicious network operations, including widespread vulnerability scanning, on behalf of the government of Iran.",
"meta": { "meta": {
"country": "IR", "country": "IR",
"references": [ "refs": [
"https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/" "https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/"
], ],
"synonyms": [ "synonyms": [
@ -11795,7 +11795,7 @@
"description": "PROPHET SPIDER is an eCrime actor, active since at least May 2017, that primarily gains access to victims by compromising vulnerable web servers, which commonly involves leveraging a variety of publicly disclosed vulnerabilities. The adversary has likely functioned as an access broker — handing off access to a third party to deploy ransomware — in multiple instances.", "description": "PROPHET SPIDER is an eCrime actor, active since at least May 2017, that primarily gains access to victims by compromising vulnerable web servers, which commonly involves leveraging a variety of publicly disclosed vulnerabilities. The adversary has likely functioned as an access broker — handing off access to a third party to deploy ransomware — in multiple instances.",
"meta": { "meta": {
"country": "", "country": "",
"references": [ "refs": [
"https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/", "https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/",
"https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/", "https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/",
"https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker", "https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker",
@ -11829,7 +11829,7 @@
"description": "According to Proofpoint, TA866 is a newly identified threat actor that distributes malware via email utilizing both commodity and custom tools. While most of the activity observed occurred since October 2022, Proofpoint researchers identified multiple activity clusters since 2019 that overlap with TA866 activity. Most of the activity recently observed by Proofpoint suggests recent campaigns are financially motivated, however assessment of historic related activities suggests a possible, additional espionage objective.", "description": "According to Proofpoint, TA866 is a newly identified threat actor that distributes malware via email utilizing both commodity and custom tools. While most of the activity observed occurred since October 2022, Proofpoint researchers identified multiple activity clusters since 2019 that overlap with TA866 activity. Most of the activity recently observed by Proofpoint suggests recent campaigns are financially motivated, however assessment of historic related activities suggests a possible, additional espionage objective.",
"meta": { "meta": {
"motive": "mainly financially motivated, additional espionage objective.", "motive": "mainly financially motivated, additional espionage objective.",
"references": [ "refs": [
"https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me" "https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me"
] ]
}, },
@ -11883,7 +11883,7 @@
"cfr-type-of-incident": [ "cfr-type-of-incident": [
"Denial of service" "Denial of service"
], ],
"references": [ "refs": [
"https://files.truesec.com/hubfs/Reports/Anonymous%20Sudan%20-%20Publish%201.2%20-%20a%20Truesec%20Report.pdf", "https://files.truesec.com/hubfs/Reports/Anonymous%20Sudan%20-%20Publish%201.2%20-%20a%20Truesec%20Report.pdf",
"https://www.truesec.com/hub/blog/what-is-anonymous-sudan" "https://www.truesec.com/hub/blog/what-is-anonymous-sudan"
] ]
@ -11906,7 +11906,7 @@
], ],
"country": "CN", "country": "CN",
"motive": "state-sponsored espionage and financially motivated", "motive": "state-sponsored espionage and financially motivated",
"references": [ "refs": [
"https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0330.pdf",
"https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer" "https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer"
] ]
@ -12084,7 +12084,7 @@
{ {
"description": "The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment.", "description": "The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment.",
"meta": { "meta": {
"references": [ "refs": [
"https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/", "https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/",
"https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded" "https://www.proofpoint.com/us/blog/threat-insight/jssloader-recoded-and-reloaded"
], ],
@ -12111,7 +12111,7 @@
"meta": { "meta": {
"country": "NG", "country": "NG",
"motive": "Cybercrime", "motive": "Cybercrime",
"references": [ "refs": [
"https://cofense.com/blog/gift-card-fraud-ecosystem-shifts-what-paxfuls-closing-means-for-business-email-compromise/", "https://cofense.com/blog/gift-card-fraud-ecosystem-shifts-what-paxfuls-closing-means-for-business-email-compromise/",
"https://static.fortra.com/agari/pdfs/guide/ag-scattered-canary-gd.pdf", "https://static.fortra.com/agari/pdfs/guide/ag-scattered-canary-gd.pdf",
"https://www.agari.com/blog/covid-19-unemployment-fraud-cares-act?_gl=1%2Ayzg6ns%2A_ga%2AMTkyMzIyOTI4MC4xNjk2MjUyMDA2%2A_ga_NHMHGJWX49%2AMTY5NjI1MjAwNS4xLjAuMTY5NjI1MjAwNS42MC4wLjA.&utm_source=press-release&utm_medium=prnewswire&utm_campaign=scattered20" "https://www.agari.com/blog/covid-19-unemployment-fraud-cares-act?_gl=1%2Ayzg6ns%2A_ga%2AMTkyMzIyOTI4MC4xNjk2MjUyMDA2%2A_ga_NHMHGJWX49%2AMTY5NjI1MjAwNS4xLjAuMTY5NjI1MjAwNS42MC4wLjA.&utm_source=press-release&utm_medium=prnewswire&utm_campaign=scattered20"
@ -12123,7 +12123,7 @@
{ {
"description": "Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.", "description": "Scattered Spider, a highly active hacking group, has made headlines by targeting more than 130 organizations, with the number of victims steadily increasing.",
"meta": { "meta": {
"references": [ "refs": [
"https://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/", "https://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/",
"https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/" "https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/"
], ],
@ -12170,7 +12170,7 @@
"Ukraine", "Ukraine",
"European Union" "European Union"
], ],
"references": [ "refs": [
"https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html", "https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html",
"https://www.trendmicro.com/en_za/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html" "https://www.trendmicro.com/en_za/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html"
], ],
@ -12201,7 +12201,7 @@
"description": "In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a Chinese-based espionage threat actor whose activities overlap with activities tracked by different researchers as Mustang Panda and LuminousMoth, whose focus is primarily on Southeast Asian countries and their close peers.", "description": "In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a Chinese-based espionage threat actor whose activities overlap with activities tracked by different researchers as Mustang Panda and LuminousMoth, whose focus is primarily on Southeast Asian countries and their close peers.",
"meta": { "meta": {
"country": "CN", "country": "CN",
"references": [ "refs": [
"https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/", "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/",
"https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/" "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/"
] ]
@ -12222,7 +12222,7 @@
], ],
"cfr-type-of-incident": "Espionage", "cfr-type-of-incident": "Espionage",
"country": "CN", "country": "CN",
"references": [ "refs": [
"https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/", "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/",
"https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr", "https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr",
"https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/" "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/"