MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-23 07:17:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

add BazarCall campaign

Browse source
This commit is contained in:
Delta-Sierra 2022-11-22 09:08:28 +01:00
parent 3c7230e38e
commit 8bf6d73d66
1 changed files with 20 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
clusters/threat-actor.json
View file

@ -2572,7 +2572,8 @@
"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf", "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf",
"https://threatintel.blog/OPBlueRaven-Part1/", "https://threatintel.blog/OPBlueRaven-Part1/",
"https://threatintel.blog/OPBlueRaven-Part2/", "https://threatintel.blog/OPBlueRaven-Part2/",
"https://www.secureworks.com/research/threat-profiles/gold-niagara" "https://www.secureworks.com/research/threat-profiles/gold-niagara",
"https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous"
], ],
"synonyms": [ "synonyms": [
"CARBON SPIDER", "CARBON SPIDER",
@ -2580,7 +2581,8 @@
"Calcium", "Calcium",
"ATK32", "ATK32",
"G0046", "G0046",
"G0008" "G0008",
"Coreid"
] ]
}, },
"related": [ "related": [
@ -9894,7 +9896,22 @@
], ],
"uuid": "8134c96d-d6ed-49cc-99d6-fe74c0636387", "uuid": "8134c96d-d6ed-49cc-99d6-fe74c0636387",
"value": "GOLD PRELUDE" "value": "GOLD PRELUDE"
},
{
"description": "BazarCall campaigns forgo malicious links or attachments in email messages in favor of phone numbers that recipients are misled into calling. It’s a technique reminiscent of vishing and tech support scams where potential victims are being cold called by the attacker, except in BazarCall’s case, targeted users must dial the number. And when they do, the users are connected with actual humans on the other end of the line, who then provide step-by-step instructions for installing malware into their devices.",
"meta": {
"refs": [
"https://www.trellix.com/en-us/about/newsroom/stories/research/evolution-of-bazarcall-social-engineering-tactics.html",
"https://www.microsoft.com/en-us/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/"
],
"synonyms": [
"BazzarCall",
"BazaCall"
]
},
"uuid": "906e2091-cc32-499e-a799-2b9b15e45042",
"value": "BazarCall"
} }
], ],
"version": 252 "version": 253
} }