From 309109eb270966a716edbbbd621bd96aa2a90726 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Wed, 25 Sep 2019 12:12:34 +0200 Subject: [PATCH] chg: [threat-actor] new LookBack (Malware?Campaign?TA?) Signed-off: During MISP training --- clusters/threat-actor.json | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 535720b..2b6af3b 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -7733,7 +7733,18 @@ }, "uuid": "7aa99279-4255-4d26-bb95-12e7156555a0", "value": "POISON CARP" + }, + { + "description": "Early in August 2019, Proofpoint described what appeared to be state-sponsored activity targeting the US utilities sector with malware that we dubbed “Lookback”. Between August 21 and August 29, 2019, several spear phishing emails were identified targeting additional US companies in the utilities sector. The phishing emails originated from what appears to be an actor-controlled domain: globalenergycertification[.]net. This domain, like those used in previous campaigns, impersonated a licensing body related to the utilities sector. In this case, it masqueraded as the legitimate domain for Global Energy Certification (“GEC”). The emails include a GEC examination-themed body and a malicious Microsoft Word attachment that uses macros to install and run LookBack. (Note confusion between Malware, Campaign and ThreatActor)", + "uuid": "5cd95926-0098-435e-892d-9c9f61763ad7", + "value": "LookBack", + "meta": { + "refs": [ + "https://www.proofpoint.com/us/threat-insight/post/lookback-forges-ahead-continued-targeting-united-states-utilities-sector-reveals", + "https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks" + ] + } } ], - "version": 134 + "version": 135 }