From 4d94ff0c129a18f8fe5a7207433148dc17150cbd Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Mon, 24 Jun 2024 02:35:57 -0700 Subject: [PATCH] [threat-actors] Add JuiceLedger --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index b05c927..44894ee 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -16209,6 +16209,16 @@ }, "uuid": "b7f37e61-0e1c-4818-9a04-8f83afdd337c", "value": "Adrastea" + }, + { + "description": "JuiceLedger is a threat actor known for infostealing through their JuiceStealer .NET assembly. They have evolved from spreading fraudulent applications to conducting supply chain attacks, targeting PyPI contributors with phishing campaigns and typosquatting. Their malicious packages contain a code snippet that downloads and executes JuiceStealer, which has evolved to support additional browsers and Discord. Victims of JuiceLedger attacks are advised to reset passwords and report any suspicious activity to security@pypi.org.", + "meta": { + "refs": [ + "https://www.sentinelone.com/labs/pypi-phishing-campaign-juiceledger-threat-actor-pivots-from-fake-apps-to-supply-chain-attacks/" + ] + }, + "uuid": "8f4eb6bc-3d3d-49e4-82d8-500c7bb0a2ec", + "value": "JuiceLedger" } ], "version": 312