MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

new ransomware and relations

Browse source
This commit is contained in:
Deborah Servili 2018-09-27 15:42:20 +02:00
parent 29beb01dc3
commit 78c1f07359
No known key found for this signature in database
GPG key ID: 7E3A832850D4D7D1
2 changed files with 37 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
clusters/exploit-kit.json
View file

@ -44,13 +44,23 @@
"description": "Fallout Exploit Kit appeared at the end of August 2018 as an updated Nuclear Pack featuring current exploits seen in competiting Exploit Kit.", "description": "Fallout Exploit Kit appeared at the end of August 2018 as an updated Nuclear Pack featuring current exploits seen in competiting Exploit Kit.",
"meta": { "meta": {
"refs": [ "refs": [
"https://www.nao-sec.org/2018/09/hello-fallout-exploit-kit.html" "https://www.nao-sec.org/2018/09/hello-fallout-exploit-kit.html",
"https://www.bleepingcomputer.com/news/security/new-fallout-exploit-kit-drops-gandcrab-ransomware-or-redirects-to-pups/"
], ],
"status": "Active", "status": "Active",
"synonyms": [ "synonyms": [
"Fallout" "Fallout"
] ]
}, },
"related": [
{
"dest-uuid": "5920464b-e093-4fa0-a275-438dffef228f",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "dropped"
}
],
"uuid": "1f05f646-5af6-4a95-825b-164f49616aa4", "uuid": "1f05f646-5af6-4a95-825b-164f49616aa4",
"value": "Fallout" "value": "Fallout"
}, },
@ -734,5 +744,5 @@
"value": "Unknown" "value": "Unknown"
} }
], ],
"version": 9 "version": 10
} }

27
clusters/ransomware.json
View file

@ -9606,9 +9606,19 @@
"https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/", "https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-distributed-by-exploit-kits-appends-gdcb-extension/",
"https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-being-distributed-via-malspam-disguised-as-receipts/", "https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-being-distributed-via-malspam-disguised-as-receipts/",
"https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-version-2-released-with-new-crab-extension-and-other-changes/", "https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-version-2-released-with-new-crab-extension-and-other-changes/",
"https://www.bleepingcomputer.com/news/security/gandcrab-version-3-released-with-autorun-feature-and-desktop-background/" "https://www.bleepingcomputer.com/news/security/gandcrab-version-3-released-with-autorun-feature-and-desktop-background/",
"https://www.bleepingcomputer.com/news/security/new-fallout-exploit-kit-drops-gandcrab-ransomware-or-redirects-to-pups/"
] ]
}, },
"related": [
{
"dest-uuid": "1f05f646-5af6-4a95-825b-164f49616aa4",
"tags": [
"estimative-language:likelihood-probability=\"almost-certain\""
],
"type": "dropped-by"
}
],
"uuid": "5920464b-e093-4fa0-a275-438dffef228f", "uuid": "5920464b-e093-4fa0-a275-438dffef228f",
"value": "GandCrab" "value": "GandCrab"
}, },
@ -10558,7 +10568,20 @@
{ {
"value": "Crypt0saur", "value": "Crypt0saur",
"uuid": "32406292-b738-11e8-ab97-1f674b130624" "uuid": "32406292-b738-11e8-ab97-1f674b130624"
},
{
"value": "Mongo Lock",
"description": "An attack called Mongo Lock is targeting remotely accessible and unprotected MongoDB databases, wiping them, and then demanding a ransom in order to get the contents back. While this new campaign is using a name to identify itself, these types of attacks are not new and MongoDB databases have been targeted for a while now. These hijacks work by attackers scanning the Internet or using services such as Shodan.io to search for unprotected MongoDB servers. Once connected, the attackers may export the databases, delete them, and then create a ransom note explaining how to get the databases back.",
"meta": {
"refs": [
"https://www.bleepingcomputer.com/news/security/mongo-lock-attack-ransoming-deleted-mongodb-databases/"
],
"ransomnotes": [
"Your database was encrypted by 'Mongo Lock'. if you want to decrypt your database, need to be pay us 0.1 BTC (Bitcoins), also don't delete 'Unique_KEY' and save it to safe place, without that we cannot help you. Send email to us: mongodb@8chan.co for decryption service."
]
},
"uuid": "2aa481fe-c254-11e8-ad1c-efee78419960"
} }
], ],
"version": 33 "version": 34
} }