MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-30 02:37:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge branch 'master' into master

Browse source
This commit is contained in:
Deborah Servili 2019-02-14 16:29:04 +01:00 committed by GitHub
commit 5bf18ffd23
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 31 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
clusters/threat-actor.json
View file

@ -363,7 +363,8 @@
"Luder", "Luder",
"Nemim", "Nemim",
"Tapaoux", "Tapaoux",
"Pioneer" "Pioneer",
"Shadow Crane"
] ]
}, },
"related": [ "related": [
@ -1562,7 +1563,7 @@
{ {
"description": "While tracking a suspected Iran-based threat group known as Threat Group-2889[1] (TG-2889), Dell SecureWorks Counter Threat Unit™ (CTU) researchers uncovered a network of fake LinkedIn profiles. These convincing profiles form a self-referenced network of seemingly established LinkedIn users. CTU researchers assess with high confidence the purpose of this network is to target potential victims through social engineering. Most of the legitimate LinkedIn accounts associated with the fake accounts belong to individuals in the Middle East, and CTU researchers assess with medium confidence that these individuals are likely targets of TG-2889. One of the threat actors responsible for the denial of service attacks against U.S in 2012–2013. Three individuals associated with the group—believed to be have been working on behalf of Iran’s Islamic Revolutionary Guard Corps—were indicted by the Justice Department in 2016. ", "description": "While tracking a suspected Iran-based threat group known as Threat Group-2889[1] (TG-2889), Dell SecureWorks Counter Threat Unit™ (CTU) researchers uncovered a network of fake LinkedIn profiles. These convincing profiles form a self-referenced network of seemingly established LinkedIn users. CTU researchers assess with high confidence the purpose of this network is to target potential victims through social engineering. Most of the legitimate LinkedIn accounts associated with the fake accounts belong to individuals in the Middle East, and CTU researchers assess with medium confidence that these individuals are likely targets of TG-2889. One of the threat actors responsible for the denial of service attacks against U.S in 2012–2013. Three individuals associated with the group—believed to be have been working on behalf of Iran’s Islamic Revolutionary Guard Corps—were indicted by the Justice Department in 2016. ",
"meta": { "meta": {
"cfr-suspected-state-sponsor": " Iran (Islamic Republic of)", "cfr-suspected-state-sponsor": "Iran (Islamic Republic of)",
"cfr-suspected-victims": [ "cfr-suspected-victims": [
"Bank of America", "Bank of America",
"US Bancorp", "US Bancorp",
@ -2933,7 +2934,8 @@
"Chinastrats", "Chinastrats",
"Patchwork", "Patchwork",
"Monsoon", "Monsoon",
"Sarit" "Sarit",
"Quilted Tiger"
] ]
}, },
"related": [ "related": [
@ -3913,7 +3915,8 @@
"APT-C-00", "APT-C-00",
"SeaLotus", "SeaLotus",
"APT-32", "APT-32",
"APT 32" "APT 32",
"Ocean Buffalo"
] ]
}, },
"related": [ "related": [
@ -4118,12 +4121,14 @@
"refs": [ "refs": [
"https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/", "https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/",
"https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/", "https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/",
"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish" "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish",
"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/"
], ],
"synonyms": [ "synonyms": [
"Cobalt group", "Cobalt group",
"Cobalt gang", "Cobalt gang",
"GOLD KINGSWOOD" "GOLD KINGSWOOD",
"Cobalt Spider"
] ]
}, },
"uuid": "01967480-c49b-4d4a-a7fa-aef0eaf535fe", "uuid": "01967480-c49b-4d4a-a7fa-aef0eaf535fe",
@ -4245,7 +4250,8 @@
"synonyms": [ "synonyms": [
"APT26", "APT26",
"Hippo Team", "Hippo Team",
"JerseyMikes" "JerseyMikes",
"Turbine Panda"
] ]
}, },
"related": [ "related": [
@ -4521,7 +4527,8 @@
"https://www.cfr.org/interactive/cyber-operations/kimsuky" "https://www.cfr.org/interactive/cyber-operations/kimsuky"
], ],
"synonyms": [ "synonyms": [
"Kimsuky" "Kimsuky",
"Velvet Chollima"
] ]
}, },
"uuid": "bcaaad6f-0597-4b89-b69b-84a6be2b7bc3", "uuid": "bcaaad6f-0597-4b89-b69b-84a6be2b7bc3",
@ -4934,7 +4941,8 @@
"https://www.cfr.org/interactive/cyber-operations/muddywater" "https://www.cfr.org/interactive/cyber-operations/muddywater"
], ],
"synonyms": [ "synonyms": [
"TEMP.Zagros" "TEMP.Zagros",
"Static Kitten"
] ]
}, },
"related": [ "related": [

14
clusters/tool.json
View file

@ -7528,6 +7528,20 @@
}, },
"uuid": "4473f19e-ad0f-4191-bb7f-a28ef7ae3be3", "uuid": "4473f19e-ad0f-4191-bb7f-a28ef7ae3be3",
"value": "Bushaloader" "value": "Bushaloader"
},
{
"description": "Backdoor",
"meta": {
"refs": [
"https://blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-adds-updated-tools-to-its-arsenal/",
"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"
],
"synonyms": [
"UPPERCUT"
]
},
"uuid": "588b97ff-3434-4aa1-a5fd-815e1bb0178b",
"value": "ANEL"
} }
], ],
"version": 109 "version": 109