From fc2b5abb6a2a6372451f846e2786604c839eb312 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 2 May 2024 04:50:10 -0700 Subject: [PATCH 1/2] [threat-actors] Add Water Orthrus --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 25b7ed2..2cc1f6a 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -15932,6 +15932,16 @@ }, "uuid": "d6882fb9-d1e4-4cec-889c-5423c772d199", "value": "USDoD" + }, + { + "description": "Water Orthrus is a threat actor known for distributing CopperStealer and CopperPhish malware. They target Microsoft 365 users with phishing campaigns to steal credit card information. The actor has evolved their malware to include rootkits for stealthy installations and has shifted their focus from personal information to cryptocurrency and credit card data. Water Orthrus has been linked to the Scranos campaign reported in 2019.", + "meta": { + "refs": [ + "https://www.trendmicro.com/en_us/research/23/e/water-orthrus-new-campaigns-deliver-rootkit-and-phishing-modules.html" + ] + }, + "uuid": "19ddf2b0-9cfb-430f-8919-49205cbec863", + "value": "Water Orthrus" } ], "version": 308 From 303eb8a0d6e193944981f976e4f41eb8f1b1f140 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 2 May 2024 04:50:10 -0700 Subject: [PATCH 2/2] [threat-actors] Add SaintBear aliases --- clusters/threat-actor.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 2cc1f6a..2d5e637 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -10497,7 +10497,9 @@ "https://unit42.paloaltonetworks.com/atoms/nascentursa/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer", "https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/", - "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/" + "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/", + "https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope", + "https://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf" ], "synonyms": [ "UNC2589", @@ -10508,7 +10510,8 @@ "FROZENVISTA", "Storm-0587", "DEV-0587", - "Saint Bear" + "Saint Bear", + "Lorec53" ] }, "uuid": "c67d3dfb-ab39-46e1-a971-5efdfe6a5b9f",