MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 16:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

several updates to apt27

Browse source
This commit is contained in:
Rony 2021-04-25 16:53:36 +05:30
parent 28f6475cc5
commit 89b9c0c32c
1 changed files with 24 additions and 157 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

181
clusters/threat-actor.json
View file

@ -999,6 +999,8 @@
"cfr-suspected-state-sponsor": "Unknown", "cfr-suspected-state-sponsor": "Unknown",
"cfr-suspected-victims": [ "cfr-suspected-victims": [
"United States", "United States",
"United Kingdom",
"France",
"Japan", "Japan",
"Taiwan", "Taiwan",
"India", "India",
@ -1009,7 +1011,8 @@
"Australia", "Australia",
"Republic of Korea", "Republic of Korea",
"Russia", "Russia",
"Iran" "Iran",
"Turkey"
], ],
"cfr-target-category": [ "cfr-target-category": [
"Government", "Government",
@ -1018,23 +1021,33 @@
"cfr-type-of-incident": "Espionage", "cfr-type-of-incident": "Espionage",
"country": "CN", "country": "CN",
"refs": [ "refs": [
"http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/",
"https://web.archive.org/web/20140129192702/https://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/", "https://web.archive.org/web/20140129192702/https://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/",
"https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/", "https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/",
"https://labs.bitdefender.com/wp-content/uploads/downloads/operation-pzchao-inside-a-highly-specialized-espionage-infrastructure/", "https://labs.bitdefender.com/wp-content/uploads/downloads/operation-pzchao-inside-a-highly-specialized-espionage-infrastructure/",
"https://www.cfr.org/interactive/cyber-operations/iron-tiger" "https://www.cfr.org/interactive/cyber-operations/iron-tiger",
"https://www.bleepingcomputer.com/news/security/chinese-cyber-espionage-group-hacked-government-data-center/",
"https://www.secureworks.com/research/bronze-union",
"http://newsroom.trendmicro.com/blog/operation-iron-tiger-attackers-shift-east-asia-united-states",
"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage",
"https://www.threatconnect.com/blog/threatconnect-discovers-chinese-apt-activity-in-europe/",
"https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/april/decoding-network-data-from-a-gh0st-rat-variant/",
"https://securelist.com/luckymouse-ndisproxy-driver/87914/",
"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/2015.09.17.Operation_Iron_Tiger/Operation%20Iron%20Tiger%20Appendix.pdf",
"https://arstechnica.com/information-technology/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/",
"https://securelist.com/luckymouse-hits-national-data-center/86083/",
"https://attack.mitre.org/groups/G0027/",
"https://www.secureworks.com/research/threat-profiles/bronze-union"
], ],
"synonyms": [ "synonyms": [
"TG-3390", "TG-3390",
"APT 27", "APT 27",
"TEMP.Hippo",
"Group 35",
"Bronze Union",
"ZipToken",
"HIPPOTeam",
"APT27", "APT27",
"Operation Iron Tiger", "TEMP.Hippo",
"Iron Tiger APT", "Red Phoenix",
"Budworm",
"Group 35",
"ZipToken",
"Iron Tiger",
"BRONZE UNION", "BRONZE UNION",
"Lucky Mouse" "Lucky Mouse"
] ]
@ -1046,24 +1059,10 @@
"estimative-language:likelihood-probability=\"likely\"" "estimative-language:likelihood-probability=\"likely\""
], ],
"type": "similar" "type": "similar"
},
{
"dest-uuid": "f1b9f7d6-6ab1-404b-91a6-a1ed1845c045",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "4af45fea-72d3-11e8-846c-d37699506c8d",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
} }
], ],
"uuid": "834e0acd-d92a-4e38-bb14-dc4159d7cb32", "uuid": "834e0acd-d92a-4e38-bb14-dc4159d7cb32",
"value": "Emissary Panda" "value": "EMISSARY PANDA"
}, },
{ {
"meta": { "meta": {
@ -3497,58 +3496,6 @@
"uuid": "a9b44750-992c-4743-8922-129880d277ea", "uuid": "a9b44750-992c-4743-8922-129880d277ea",
"value": "DragonOK" "value": "DragonOK"
}, },
{
"description": "Chinese threat group that has extensively used strategic Web compromises to target victims.",
"meta": {
"attribution-confidence": "50",
"cfr-suspected-state-sponsor": " China",
"cfr-suspected-victims": [
"United States",
"United Kingdom",
"France"
],
"cfr-target-category": [
"Government",
"Private sector"
],
"cfr-type-of-incident": "Espionage",
"country": "CN",
"refs": [
"http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/",
"https://attack.mitre.org",
"https://www.cfr.org/interactive/cyber-operations/emissary-panda"
],
"synonyms": [
"TG-3390",
"Emissary Panda"
]
},
"related": [
{
"dest-uuid": "fb366179-766c-4a4a-afa1-52bff1fd601c",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "834e0acd-d92a-4e38-bb14-dc4159d7cb32",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "4af45fea-72d3-11e8-846c-d37699506c8d",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "f1b9f7d6-6ab1-404b-91a6-a1ed1845c045",
"value": "Threat Group-3390"
},
{ {
"description": "ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods. Technical details show how attackers learned from other extremely advanced actors in order to avoid repeating their mistakes. As such, all artifacts are customized per given target, reducing their value as indicators of compromise for any other victim. Usually APT campaigns have a geographical nexus, aimed at extracting information within a specific region or from a given industry. That usually results in several infections in countries within that region, or in the targeted industry around the world. Interestingly, ProjectSauron seems to be dedicated to just a couple of countries, focused on collecting high value intelligence by compromising almost all key entities it could possibly reach within the target area. The name, ProjectSauron reflects the fact that the code authors refer to ‘Sauron’ in the Lua scripts.", "description": "ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods. Technical details show how attackers learned from other extremely advanced actors in order to avoid repeating their mistakes. As such, all artifacts are customized per given target, reducing their value as indicators of compromise for any other victim. Usually APT campaigns have a geographical nexus, aimed at extracting information within a specific region or from a given industry. That usually results in several infections in countries within that region, or in the targeted industry around the world. Interestingly, ProjectSauron seems to be dedicated to just a couple of countries, focused on collecting high value intelligence by compromising almost all key entities it could possibly reach within the target area. The name, ProjectSauron reflects the fact that the code authors refer to ‘Sauron’ in the Lua scripts.",
"meta": { "meta": {
@ -6124,86 +6071,6 @@
"uuid": "4defbf2e-4f73-11e8-807f-578d61da7568", "uuid": "4defbf2e-4f73-11e8-807f-578d61da7568",
"value": "ZooPark" "value": "ZooPark"
}, },
{
"description": "Experts assigned the codename of LuckyMouse to the group behind this hack, but they later realized the attackers were an older Chinese threat actor known under various names in the reports of other cyber-security firms, such as Emissary Panda, APT27, Threat Group 3390, Bronze Union, ZipToken, and Iron Tiger",
"meta": {
"attribution-confidence": "50",
"cfr-suspected-state-sponsor": "Unknown",
"cfr-suspected-victims": [
"United States",
"Japan",
"Taiwan",
"India",
"Canada",
"China",
"Thailand",
"Israel",
"Australia",
"Republic of Korea",
"Russia",
"Iran"
],
"cfr-target-category": [
"Government",
"Private sector"
],
"cfr-type-of-incident": "Espionage",
"refs": [
"https://www.bleepingcomputer.com/news/security/chinese-cyber-espionage-group-hacked-government-data-center/",
"https://www.secureworks.com/research/bronze-union",
"http://newsroom.trendmicro.com/blog/operation-iron-tiger-attackers-shift-east-asia-united-states",
"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage",
"https://www.threatconnect.com/blog/threatconnect-discovers-chinese-apt-activity-in-europe/",
"https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/april/decoding-network-data-from-a-gh0st-rat-variant/",
"https://securelist.com/luckymouse-ndisproxy-driver/87914/",
"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/2015.09.17.Operation_Iron_Tiger/Operation%20Iron%20Tiger%20Appendix.pdf",
"https://www.cfr.org/interactive/cyber-operations/iron-tiger",
"https://arstechnica.com/information-technology/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/",
"https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/",
"https://securelist.com/luckymouse-hits-national-data-center/86083/",
"https://attack.mitre.org/groups/G0027/",
"https://www.secureworks.com/research/threat-profiles/bronze-union",
"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/incident-response-polar-ransomware-apt27/"
],
"synonyms": [
"Emissary Panda",
"APT27",
"APT 27",
"Threat Group 3390",
"Bronze Union",
"Iron Tiger",
"TG-3390",
"TEMP.Hippo",
"Group 35",
"ZipToken"
]
},
"related": [
{
"dest-uuid": "fb366179-766c-4a4a-afa1-52bff1fd601c",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "834e0acd-d92a-4e38-bb14-dc4159d7cb32",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "f1b9f7d6-6ab1-404b-91a6-a1ed1845c045",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "4af45fea-72d3-11e8-846c-d37699506c8d",
"value": "LuckyMouse"
},
{ {
"description": "The Rancor group’s attacks use two primary malware families which are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit. Countries Unit 42 has identified as targeted by Rancor with these malware families include, but are not limited to Singapore and Cambodia.", "description": "The Rancor group’s attacks use two primary malware families which are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit. Countries Unit 42 has identified as targeted by Rancor with these malware families include, but are not limited to Singapore and Cambodia.",
"meta": { "meta": {