MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-23 07:17:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Update threat-actor.json

Browse source 
Adding Fox-Kitten and cleaned (or improved) winnti
This commit is contained in:
Rony 2020-09-17 00:07:40 +05:30 committed by GitHub
parent b989916caf
commit 4d4a462d7a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 35 additions and 16 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
clusters/threat-actor.json
View file

@ -640,31 +640,26 @@
"https://attack.mitre.org/groups/G0044/", "https://attack.mitre.org/groups/G0044/",
"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-july-wicked-spider/", "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-july-wicked-spider/",
"https://www.secureworks.com/research/threat-profiles/bronze-atlas", "https://www.secureworks.com/research/threat-profiles/bronze-atlas",
"https://www.secureworks.com/research/threat-profiles/bronze-export" "https://www.secureworks.com/research/threat-profiles/bronze-export",
"https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf",
"https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer"
], ],
"synonyms": [ "synonyms": [
"Winnti Umbrella", "Winnti Umbrella",
"Winnti Group", "Winnti Group",
"WinNTI",
"Tailgater Team",
"Suckfly", "Suckfly",
"APT41", "APT41",
"APT 41", "APT 41",
"Group 72",
"Group72", "Group72",
"Tailgater", "Group 72",
"Ragebeast",
"Blackfly", "Blackfly",
"Lead", "LEAD",
"Wicked Spider", "WICKED SPIDER",
"APT17", "WICKED PANDA",
"APT 17", "BARIUM",
"Dogfish",
"Deputy Dog",
"Wicked Panda",
"Barium",
"BRONZE ATLAS", "BRONZE ATLAS",
"BRONZE EXPORT" "BRONZE EXPORT",
"Red Kelpie"
] ]
}, },
"related": [ "related": [
@ -8364,7 +8359,31 @@
}, },
"uuid": "b6f3150f-2240-4c57-9dda-5144c5077058", "uuid": "b6f3150f-2240-4c57-9dda-5144c5077058",
"value": "Evilnum" "value": "Evilnum"
},
{
"description": "PIONEER KITTEN is an Iran-based adversary that has been active since at least 2017 and has a suspected nexus to the Iranian government. This adversary appears to be primarily focused on gaining and maintaining access to entities possessing sensitive information of likely intelligence interest to the Iranian government. According to DRAGOS, they also targeted ICS-related entities using known VPN vulnerabilities. They are widely known to use open source penetration testing tools for reconnaissance and to establish encrypted communications.",
"meta": {
"country": "IR",
"refs": [
"https://youtu.be/pBDu8EGWRC4?t=2492",
"https://www.dragos.com/threat/parisite",
"https://www.dragos.com/wp-content/uploads/The-ICS-Threat-Landscape.pdf",
"https://www.dragos.com/wp-content/uploads/NA-EL-Threat-Perspective-2019.pdf",
"https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign.pdf",
"https://www.zdnet.com/article/fbi-says-an-iranian-hacking-group-is-attacking-f5-networking-devices",
"https://www.crowdstrike.com/blog/who-is-pioneer-kitten",
"https://www.zdnet.com/article/iranian-hackers-are-selling-access-to-compromised-companies-on-an-underground-forum",
"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"
],
"synonyms": [
"PIONEER KITTEN",
"PARISITE",
"UNC757"
]
},
"uuid": "bfb0bc20-5bdf-47ff-b07f-dbd9a3cb9772",
"value": "Fox Kitten"
} }
], ],
"version": 178 "version": 179
} }