MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add ItaDuke/DarkUniverse actor

Browse source
This commit is contained in:
itayc0hen 2020-04-22 19:44:38 +03:00
parent 2a5ea5f521
commit 667d5b8850
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
clusters/threat-actor.json
View file

@ -8098,6 +8098,22 @@
}, },
"uuid": "86b4e2f3-8bbf-48fd-9d27-034d3ac3b187", "uuid": "86b4e2f3-8bbf-48fd-9d27-034d3ac3b187",
"value": "VENOM SPIDER" "value": "VENOM SPIDER"
},
{
"description": "ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by Kaspersky.",
"meta": {
"refs": [
"https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/",
"https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html",
"https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465"
],
"synonyms": [
"DarkUniverse",
"SIG27"
]
},
"uuid": "d0b900fa-84b4-11ea-bc55-0242ac130003",
"value": "ItaDuke"
} }
], ],
"version": 157 "version": 157