MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[threat-actors] Add UNC4536

Browse source
This commit is contained in:
Mathieu4141 2024-09-09 08:18:23 -07:00
parent d8ee3beada
commit 47983fed20
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
clusters/threat-actor.json
View file

@ -16581,6 +16581,16 @@
}, },
"uuid": "b1fd5c1a-f0e9-42b1-b386-9925c02ba508", "uuid": "b1fd5c1a-f0e9-42b1-b386-9925c02ba508",
"value": "SILKFIN AGENCY" "value": "SILKFIN AGENCY"
},
{
"description": "UNC4536 is a threat actor that distributes malware, including ICEDID, REDLINESTEALER, and CARBANAK, primarily through malvertising and trojanized MSIX installers masquerading as popular software. They utilize SEO poisoning tactics to direct victims to malicious sites that mimic legitimate software hosting platforms, facilitating the download of compromised installers. The actor employs a PowerShell script known as NUMOZYLOD to deliver tailored payloads, such as the CARBANAK backdoor, to their partners. Additionally, UNC4536 has been linked to campaigns that distribute NetSupport RAT, targeting IT administrators through fake sites promoted via Google Ads.",
"meta": {
"refs": [
"https://www.googlecloudcommunity.com/gc/Community-Blog/Finding-Malware-Unveiling-NUMOZYLOD-with-Google-Security/ba-p/789551"
]
},
"uuid": "5a00ccdb-7987-4563-af4f-e368af8406df",
"value": "UNC4536"
} }
], ],
"version": 313 "version": 313