MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

chg: [threat-actor] SandCat added

Browse source
This commit is contained in:
Alexandre Dulaunoy 2019-03-14 06:18:10 +01:00
parent b18b280419
commit 5db30ba974
Signed by: adulau
GPG key ID: 09E2CD4944E6CBCD
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
clusters/threat-actor.json
View file

@ -2922,7 +2922,8 @@
"country": "AE", "country": "AE",
"refs": [ "refs": [
"https://citizenlab.org/2016/05/stealth-falcon/", "https://citizenlab.org/2016/05/stealth-falcon/",
"https://www.cfr.org/interactive/cyber-operations/stealth-falcon" "https://www.cfr.org/interactive/cyber-operations/stealth-falcon",
"https://securelist.com/cve-2019-0797-zero-day-vulnerability/89885/"
], ],
"synonyms": [ "synonyms": [
"FruityArmor" "FruityArmor"
@ -6609,7 +6610,17 @@
}, },
"uuid": "29cfe970-5446-4cfc-a2da-00e9f49e02ba", "uuid": "29cfe970-5446-4cfc-a2da-00e9f49e02ba",
"value": "IRIDIUM" "value": "IRIDIUM"
},
{
"description": "SandCat, on the other hand, is a group that was discovered more recently by Kaspersky. One of the Windows vulnerabilities patched by Microsoft in December had been exploited by both FruityArmor and SandCat in attacks targeting the Middle East and Africa. SandCat has been using FinFisher/FinSpy spyware and CHAINSHOT, a piece of malware analyzed earlier this year by Palo Alto Networks. The group has also used the CVE-2018-8589 and CVE-2018-8611 Windows vulnerabilities in its attacks, both of which had a zero-day status when Microsoft released fixes.",
"meta": {
"refs": [
"https://securelist.com/zero-day-in-windows-kernel-transaction-manager-cve-2018-8611/89253/"
]
},
"uuid": "dc15f388-a353-4185-b28e-015745f708ba",
"value": "SandCat"
} }
], ],
"version": 98 "version": 99
} }