From 5cac510818894891d5589586f555f42cd1461658 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Wed, 13 Dec 2017 14:57:38 +0100 Subject: [PATCH] update threat actor galaxy --- clusters/threat-actor.json | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 7d2d61b..d5aeb11 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -2230,6 +2230,17 @@ }, "description": "The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. MuddyWater attacks are characterized by the use of a slowly evolving PowerShell-based first stage backdoor we call “POWERSTATS”. Despite broad scrutiny and reports on MuddyWater attacks, the activity continues with only incremental changes to the tools and techniques.", "value": "MuddyWater" + }, + { + "meta": { + "refs": [ + "https://www.bleepingcomputer.com/news/security/moneytaker-hacker-group-steals-millions-from-us-and-russian-banks/", + "https://www.group-ib.com/resources/reports/money-taker.html", + "https://www.group-ib.com/blog/moneytaker" + ] + }, + "description": "In less than two years, this group has conducted over 20 successful attacks on financial institutions and legal firms in the USA, UK and Russia. The group has primarily been targeting card processing systems, including the AWS CBR (Russian Interbank System) and purportedly SWIFT (US). Given the wide usage of STAR in LATAM, financial institutions in LATAM could have particular exposure to a potential interest from the MoneyTaker group.", + "value": "MoneyTaker" } ], "name": "Threat actor", @@ -2244,5 +2255,5 @@ ], "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.", "uuid": "7cdff317-a673-4474-84ec-4f1754947823", - "version": 29 + "version": 30 }