mirror of
https://github.com/MISP/misp-galaxy.git
synced 2024-11-26 00:37:18 +00:00
Fix validation, remove duplicate.
This commit is contained in:
Raphaël Vinot
parent
47ac01ee96
commit
910398fe76
8 changed files with 483 additions and 451 deletions
|
|
@ -1,6 +1,7 @@
|
|||
{
|
||||
"values": [
|
||||
{ "value": "Astrum",
|
||||
{
|
||||
"value": "Astrum",
|
||||
"description": "Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -12,9 +13,9 @@
|
|||
],
|
||||
"status": "Unknown - Last Seen 2016-12-07"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "DealersChoice",
|
||||
},
|
||||
{
|
||||
"value": "DealersChoice",
|
||||
"description": "DealersChoice is a Flash Player Exploit platform triggered by RTF",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -26,9 +27,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "DNSChanger",
|
||||
},
|
||||
{
|
||||
"value": "DNSChanger",
|
||||
"description": "DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -40,9 +41,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Empire",
|
||||
},
|
||||
{
|
||||
"value": "Empire",
|
||||
"description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -50,13 +51,12 @@
|
|||
],
|
||||
"synonyms": [
|
||||
"RIG-E"
|
||||
]
|
||||
,
|
||||
],
|
||||
"status": "Unknown - Last seen: 2016-12-29"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Hunter",
|
||||
},
|
||||
{
|
||||
"value": "Hunter",
|
||||
"description": "Hunter EK is an evolution of 3Ros EK",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -64,13 +64,12 @@
|
|||
],
|
||||
"synonyms": [
|
||||
"3ROS Exploit Kit"
|
||||
]
|
||||
,
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Kaixin",
|
||||
},
|
||||
{
|
||||
"value": "Kaixin",
|
||||
"description": "Kaixin is an exploit kit mainly seen behind compromised website in Asia",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -82,9 +81,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Magnitude",
|
||||
},
|
||||
{
|
||||
"value": "Magnitude",
|
||||
"description": "Magnitude EK",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -98,9 +97,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "MWI",
|
||||
},
|
||||
{
|
||||
"value": "MWI",
|
||||
"description": "Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -109,9 +108,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Neutrino",
|
||||
},
|
||||
{
|
||||
"value": "Neutrino",
|
||||
"description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -122,13 +121,12 @@
|
|||
"Job314",
|
||||
"Neutrino Rebooted",
|
||||
"Neutrino-v"
|
||||
]
|
||||
,
|
||||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "RIG",
|
||||
},
|
||||
{
|
||||
"value": "RIG",
|
||||
"description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -145,9 +143,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Sednit EK",
|
||||
},
|
||||
{
|
||||
"value": "Sednit EK",
|
||||
"description": "Sednit EK is the exploit kit used by APT28",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -156,9 +154,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Bizarro Sundown",
|
||||
},
|
||||
{
|
||||
"value": "Bizarro Sundown",
|
||||
"description": "Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -170,9 +168,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "GreenFlash Sundown",
|
||||
},
|
||||
{
|
||||
"value": "GreenFlash Sundown",
|
||||
"description": "GreenFlash Sundown is a variation of Bizarro Sundown without landing",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -183,9 +181,9 @@
|
|||
],
|
||||
"status": "Active"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Sundown",
|
||||
},
|
||||
{
|
||||
"value": "Sundown",
|
||||
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -200,9 +198,9 @@
|
|||
"status": "Active",
|
||||
"colour": "#C03701"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Angler",
|
||||
},
|
||||
{
|
||||
"value": "Angler",
|
||||
"description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -217,9 +215,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2016-06-07"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Archie",
|
||||
},
|
||||
{
|
||||
"value": "Archie",
|
||||
"description": "Archie EK",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -227,9 +225,9 @@
|
|||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "BlackHole",
|
||||
},
|
||||
{
|
||||
"value": "BlackHole",
|
||||
"description": "The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -241,9 +239,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2013-10-07"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Bleeding Life",
|
||||
},
|
||||
{
|
||||
"value": "Bleeding Life",
|
||||
"description": "Bleeding Life is an exploit kit that became open source with its version 2",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -253,13 +251,12 @@
|
|||
"synonyms": [
|
||||
"BL",
|
||||
"BL2"
|
||||
]
|
||||
,
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Cool",
|
||||
},
|
||||
{
|
||||
"value": "Cool",
|
||||
"description": "The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -273,9 +270,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2013-10-07"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Fiesta",
|
||||
},
|
||||
{
|
||||
"value": "Fiesta",
|
||||
"description": "Fiesta Exploit Kit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -285,13 +282,12 @@
|
|||
"synonyms": [
|
||||
"NeoSploit",
|
||||
"Fiexp"
|
||||
]
|
||||
,
|
||||
],
|
||||
"status": "Retired - Last Seen: beginning of 2015-07"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "FlashPack",
|
||||
},
|
||||
{
|
||||
"value": "FlashPack",
|
||||
"description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -303,13 +299,12 @@
|
|||
"SafePack",
|
||||
"CritXPack",
|
||||
"Vintage Pack"
|
||||
]
|
||||
,
|
||||
],
|
||||
"status": "Retired - Last seen: middle of 2015-04"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "GrandSoft",
|
||||
},
|
||||
{
|
||||
"value": "GrandSoft",
|
||||
"description": "GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -323,9 +318,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2014-03"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "HanJuan",
|
||||
},
|
||||
{
|
||||
"value": "HanJuan",
|
||||
"description": "Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -336,9 +331,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2015-07"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Himan",
|
||||
},
|
||||
{
|
||||
"value": "Himan",
|
||||
"description": "Himan Exploit Kit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -349,20 +344,19 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2014-04"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Impact",
|
||||
},
|
||||
{
|
||||
"value": "Impact",
|
||||
"description": "Impact EK",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://malware.dontneedcoffee.com/2012/12/inside-impact-exploit-kit-back-on-track.html"
|
||||
]
|
||||
,
|
||||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Infinity",
|
||||
},
|
||||
{
|
||||
"value": "Infinity",
|
||||
"description": "Infinity is an evolution of Redkit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -375,9 +369,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2014-07"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Lightsout",
|
||||
},
|
||||
{
|
||||
"value": "Lightsout",
|
||||
"description": "Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -387,9 +381,9 @@
|
|||
],
|
||||
"status": "Unknown - Last seen: 2014-03"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Niteris",
|
||||
},
|
||||
{
|
||||
"value": "Niteris",
|
||||
"description": "Niteris was used mainly to target Russian.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -401,9 +395,9 @@
|
|||
],
|
||||
"status": "Unknown - Last seen: 2015-11"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Nuclear",
|
||||
},
|
||||
{
|
||||
"value": "Nuclear",
|
||||
"description": "The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -417,9 +411,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2015-04-30"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Phoenix",
|
||||
},
|
||||
{
|
||||
"value": "Phoenix",
|
||||
"description": "Phoenix Exploit Kit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -431,9 +425,9 @@
|
|||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Private Exploit Pack",
|
||||
},
|
||||
{
|
||||
"value": "Private Exploit Pack",
|
||||
"description": "Private Exploit Pack",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -445,9 +439,9 @@
|
|||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Redkit",
|
||||
},
|
||||
{
|
||||
"value": "Redkit",
|
||||
"description": "Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -457,9 +451,9 @@
|
|||
],
|
||||
"status": "Retired"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Sakura",
|
||||
},
|
||||
{
|
||||
"value": "Sakura",
|
||||
"description": "Description Here",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -467,9 +461,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2013-09"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Sweet-Orange",
|
||||
},
|
||||
{
|
||||
"value": "Sweet-Orange",
|
||||
"description": "Sweet Orange",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -481,9 +475,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2015-04-05"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Styx",
|
||||
},
|
||||
{
|
||||
"value": "Styx",
|
||||
"description": "Styx Exploit Kit",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -493,9 +487,9 @@
|
|||
],
|
||||
"status": "Retired - Last seen: 2014-06"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Unknown",
|
||||
},
|
||||
{
|
||||
"value": "Unknown",
|
||||
"description": "Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
|
|||
|
|
@ -4,21 +4,27 @@
|
|||
"value": "PROMETHIUM",
|
||||
"description": "PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.",
|
||||
"meta": {
|
||||
"refs": ["https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"]
|
||||
"refs": [
|
||||
"https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "NEODYMIUM",
|
||||
"description": "NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.",
|
||||
"meta": {
|
||||
"refs": ["https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"]
|
||||
"refs": [
|
||||
"https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "TERBIUM",
|
||||
"description": "Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.",
|
||||
"meta": {
|
||||
"refs": ["https://blogs.technet.microsoft.com/mmpc/2016/12/09/windows-10-protection-detection-and-response-against-recent-attacks/"]
|
||||
"refs": [
|
||||
"https://blogs.technet.microsoft.com/mmpc/2016/12/09/windows-10-protection-detection-and-response-against-recent-attacks/"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -74,14 +80,19 @@
|
|||
"value": "BARIUM",
|
||||
"description": "Microsoft Threat Intelligence associates Winnti with multiple activity groups—collections of malware, supporting infrastructure, online personas, victimology, and other attack artifacts that the Microsoft intelligent security graph uses to categorize and attribute threat activity. Microsoft labels activity groups using code names derived from elements in the periodic table. In the case of this malware, the activity groups strongly associated with Winnti are BARIUM and LEAD. But even though they share the use of Winnti, the BARIUM and LEAD activity groups are involved in very different intrusion scenarios. BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms. Once BARIUM has established rapport, they spear-phish the victim using a variety of unsophisticated malware installation vectors, including malicious shortcut (.lnk) files with hidden payloads, compiled HTML help (.chm) files, or Microsoft Office documents containing macros or exploits. Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles, collaborative document editing sites, and blogs for C&C. Later stages of the intrusions rely upon Winnti for persistent access. The majority of victims recorded to date have been in electronic gaming, multimedia, and Internet content industries, although occasional intrusions against technology companies have occurred.",
|
||||
"meta": {
|
||||
"refs": ["https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/"]
|
||||
"refs": [
|
||||
"https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "LEAD",
|
||||
"description": "In contrast, LEAD has established a far greater reputation for industrial espionage. In the past few years, LEAD’s victims have included: Multinational, multi-industry companies involved in the manufacture of textiles, chemicals, and electronics Pharmaceutical companies A company in the chemical industry University faculty specializing in aeronautical engineering and research A company involved in the design and manufacture of motor vehicles A cybersecurity company focusing on protecting industrial control systems During these intrusions, LEAD’s objective was to steal sensitive data, including research materials, process documents, and project plans. LEAD also steals code-signing certificates to sign its malware in subsequent attacks. In most cases, LEAD’s attacks do not feature any advanced exploit techniques. The group also does not make special effort to cultivate victims prior to an attack. Instead, the group often simply emails a Winnti installer to potential victims, relying on basic social engineering tactics to convince recipients to run the attached malware. In some other cases, LEAD gains access to a target by brute-forcing remote access login credentials, performing SQL injection, or exploiting unpatched web servers, and then they copy the Winnti installer directly to compromised machines.",
|
||||
"meta": {
|
||||
"refs": ["https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/"] }
|
||||
"refs": [
|
||||
"https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"name": "Microsoft Activity Group actor",
|
||||
|
|
@ -94,4 +105,3 @@
|
|||
"uuid": "28b5e55d-acba-4748-a79d-0afa3512689a",
|
||||
"version": 2
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
{
|
||||
"values": [
|
||||
{ "value": "Keitaro",
|
||||
{
|
||||
"value": "Keitaro",
|
||||
"description": "Keitaro TDS is among the mostly used TDS in drive by infection chains",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -8,9 +9,9 @@
|
|||
]
|
||||
},
|
||||
"type": "Commercial"
|
||||
}
|
||||
,
|
||||
{ "value": "Sutra",
|
||||
},
|
||||
{
|
||||
"value": "Sutra",
|
||||
"description": "Sutra TDS was dominant from 2012 till 2015",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -18,9 +19,9 @@
|
|||
],
|
||||
"type": "Commercial"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "SimpleTDS",
|
||||
},
|
||||
{
|
||||
"value": "SimpleTDS",
|
||||
"description": "SimpleTDS is a basic open source TDS",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -31,9 +32,9 @@
|
|||
],
|
||||
"type": "OpenSource"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "BossTDS",
|
||||
},
|
||||
{
|
||||
"value": "BossTDS",
|
||||
"description": "BossTDS",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -41,9 +42,9 @@
|
|||
],
|
||||
"type": "Commercial"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "BlackHat TDS",
|
||||
},
|
||||
{
|
||||
"value": "BlackHat TDS",
|
||||
"description": "BlackHat TDS is sold underground.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
|
|
@ -51,16 +52,16 @@
|
|||
],
|
||||
"type": "Underground"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Futuristic TDS",
|
||||
},
|
||||
{
|
||||
"value": "Futuristic TDS",
|
||||
"description": "Futuristic TDS is the TDS component of BlackOS/CookieBomb/NorthTale Iframer",
|
||||
"meta": {
|
||||
"type": "Underground"
|
||||
}
|
||||
}
|
||||
,
|
||||
{ "value": "Orchid TDS",
|
||||
},
|
||||
{
|
||||
"value": "Orchid TDS",
|
||||
"description": "Orchid TDS was sold underground. Rare usage",
|
||||
"meta": {
|
||||
"type": "Underground"
|
||||
|
|
|
|||
|
|
@ -435,7 +435,7 @@
|
|||
"Motive": "Espionage"
|
||||
},
|
||||
"value": "Anchor Panda",
|
||||
"Description": "PLA Navy"
|
||||
"description": "PLA Navy"
|
||||
},
|
||||
{
|
||||
"meta": {
|
||||
|
|
@ -990,24 +990,28 @@
|
|||
"description": "Group targeting Indian Army or related assets in India. Attribution to a Pakistani connection has been made by TrendMicro."
|
||||
},
|
||||
{
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://citizenlab.org/2016/05/stealth-falcon/"
|
||||
],
|
||||
"country": "UAE",
|
||||
"value": "Stealth Falcon",
|
||||
"description": "Group targeting Emirati journalists, activists, and dissidents.",
|
||||
"synonyms": [
|
||||
"FruityArmor"
|
||||
]
|
||||
],
|
||||
"country": "UAE"
|
||||
},
|
||||
"value": "Stealth Falcon",
|
||||
"description": "Group targeting Emirati journalists, activists, and dissidents."
|
||||
},
|
||||
{
|
||||
"meta": {
|
||||
"synonyms": [
|
||||
"Operation Daybreak",
|
||||
"Operation Erebus"
|
||||
],
|
||||
"refs": [
|
||||
"https://securelist.com/blog/research/75082/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/"
|
||||
],
|
||||
]
|
||||
},
|
||||
"value": "ScarCruft",
|
||||
"description": "ScarCruft is a relatively new APT group; victims have been observed in several countries, including Russia, Nepal, South Korea, China, India, Kuwait and Romania. The group has several ongoing operations utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer."
|
||||
},
|
||||
|
|
@ -1356,14 +1360,18 @@
|
|||
"description": "The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophisticated cyber attack groups in the world, operating alongside but always from a position of superiority with the creators of Stuxnet and Flame",
|
||||
"meta": {
|
||||
"country": "US",
|
||||
"refs": ["https://en.wikipedia.org/wiki/Equation_Group"]
|
||||
"refs": [
|
||||
"https://en.wikipedia.org/wiki/Equation_Group"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Greenbug",
|
||||
"description": "Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors.",
|
||||
"meta": {
|
||||
"refs": ["https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon"]
|
||||
"refs": [
|
||||
"https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
|
|
@ -1379,5 +1387,5 @@
|
|||
],
|
||||
"description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.",
|
||||
"uuid": "7cdff317-a673-4474-84ec-4f1754947823",
|
||||
"version": 13
|
||||
"version": 14
|
||||
}
|
||||
|
|
|
|||
|
|
@ -47,23 +47,13 @@
|
|||
{
|
||||
"value": "ZeGhost"
|
||||
},
|
||||
{
|
||||
"value": "Backdoor.Dripion",
|
||||
"description": "Backdoor.Dripion was custom developed, deployed in a highly targeted fashion, and used command and control servers disguised as antivirus company websites.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"http://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan"
|
||||
],
|
||||
"synonyms": [
|
||||
"Dripion"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Elise Backdoor",
|
||||
"meta": {
|
||||
"synonyms": [
|
||||
"Elise"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Trojan.Laziok",
|
||||
|
|
@ -104,7 +94,7 @@
|
|||
},
|
||||
{
|
||||
"value": "Lost Door RAT",
|
||||
"descriptions": "We recently came across a cyber attack that used a remote access Trojan (RAT) called Lost Door, a tool currently offered on social media sites. What also struck us the most about this RAT (detected as BKDR_LODORAT.A) is how it abuses the Port Forward feature in routers.",
|
||||
"description": "We recently came across a cyber attack that used a remote access Trojan (RAT) called Lost Door, a tool currently offered on social media sites. What also struck us the most about this RAT (detected as BKDR_LODORAT.A) is how it abuses the Port Forward feature in routers.",
|
||||
"meta": {
|
||||
"synonyms": [
|
||||
"LostDoor RAT"
|
||||
|
|
@ -210,8 +200,13 @@
|
|||
"value": "Wipbot",
|
||||
"description": "Waterbug is the name given to the actors who use the malware tools Trojan.Wipbot (also known as Tavdig and Epic Turla)",
|
||||
"meta": {
|
||||
"synonyms": ["Tavdig", "Epic Turla"],
|
||||
"refs": ["https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"]
|
||||
"synonyms": [
|
||||
"Tavdig",
|
||||
"Epic Turla"
|
||||
],
|
||||
"refs": [
|
||||
"https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -440,8 +435,13 @@
|
|||
"value": "Regin",
|
||||
"description": "Regin (also known as Prax or WarriorPride) is a sophisticated malware toolkit revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. The malware targets specific users of Microsoft Windows-based computers and has been linked to the US intelligence gathering agency NSA and its British counterpart, the GCHQ. The Intercept provided samples of Regin for download including malware discovered at Belgian telecommunications provider, Belgacom. Kaspersky Lab says it first became aware of Regin in spring 2012, but that some of the earliest samples date from 2003. The name Regin is first found on the VirusTotal website on 9 March 2011.",
|
||||
"meta": {
|
||||
"refs": ["https://en.wikipedia.org/wiki/Regin_(malware)"],
|
||||
"synonyms": ["Prax","WarriorPride"]
|
||||
"refs": [
|
||||
"https://en.wikipedia.org/wiki/Regin_(malware)"
|
||||
],
|
||||
"synonyms": [
|
||||
"Prax",
|
||||
"WarriorPride"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
|
|
@ -925,9 +925,11 @@
|
|||
{
|
||||
"value": "Odinaff",
|
||||
"description": "Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network. These additional tools bear the hallmarks of a sophisticated attacker which has plagued the financial industry since at least 2013–Carbanak. This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.",
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Hworm",
|
||||
|
|
@ -1167,13 +1169,13 @@
|
|||
},
|
||||
{
|
||||
"value": "DownRage",
|
||||
"synonyms": [
|
||||
"Carberplike"
|
||||
],
|
||||
"meta": {
|
||||
"refs": [
|
||||
"https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/",
|
||||
"https://twitter.com/Timo_Steffens/status/814781584536719360"
|
||||
],
|
||||
"synonyms": [
|
||||
"Carberplike"
|
||||
]
|
||||
}
|
||||
},
|
||||
|
|
@ -1248,7 +1250,9 @@
|
|||
},
|
||||
{
|
||||
"meta": {
|
||||
"refs": ["https://en.wikipedia.org/wiki/Shamoon"]
|
||||
"refs": [
|
||||
"https://en.wikipedia.org/wiki/Shamoon"
|
||||
]
|
||||
},
|
||||
"description": "Shamoon,[a] also known as Disttrack, is a modular computer virus discovered by Seculert[1] in 2012, targeting recent NT kernel-based versions of Microsoft Windows. The virus has been used for cyber espionage in the energy sector.[2][3][4] Its discovery was announced on 16 August 2012 by Symantec,[3] Kaspersky Lab,[5] and Seculert.[6] Similarities have been highlighted by Kaspersky Lab and Seculert between Shamoon and the Flame malware.[5][6]",
|
||||
"value": "Shamoon"
|
||||
|
|
@ -1257,14 +1261,18 @@
|
|||
"value": "GhostAdmin",
|
||||
"description": "According to MalwareHunterTeam and other researchers that have looked at the malware's source code, GhostAdmin seems to be a reworked version of CrimeScene, another botnet malware family that was active around 3-4 years ago.",
|
||||
"meta": {
|
||||
"refs": ["https://www.bleepingcomputer.com/news/security/new-ghostadmin-malware-used-for-data-theft-and-exfiltration/"]
|
||||
"refs": [
|
||||
"https://www.bleepingcomputer.com/news/security/new-ghostadmin-malware-used-for-data-theft-and-exfiltration/"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": " EyePyramid Malware",
|
||||
"description": "Two Italians referred to as the “Occhionero brothers” have been arrested and accused of using malware and a carefully-prepared spear-phishing scheme to spy on high-profile politicians and businessmen. This case has been called “EyePyramid”, which we first discussed last week. (Conspiracy theories aside, the name came from a domain name and directory path that was found during the research.)",
|
||||
"meta": {
|
||||
"refs": ["http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid/"],
|
||||
"refs": [
|
||||
"http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid/"
|
||||
],
|
||||
"country": "IT"
|
||||
}
|
||||
},
|
||||
|
|
@ -1272,36 +1280,47 @@
|
|||
"value": "LuminosityLink",
|
||||
"description": "LuminosityLink is a malware family costing $40 that purports to be a system administration utility",
|
||||
"meta": {
|
||||
"refs": ["http://researchcenter.paloaltonetworks.com/2016/07/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/"]
|
||||
"refs": [
|
||||
"http://researchcenter.paloaltonetworks.com/2016/07/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "Flokibot",
|
||||
"description": "Floki Bot, described recently by Dr. Peter Stephenson from SC Magazine, is yet another bot based on the leaked Zeus code. However, the author came up with various custom modifications that makes it more interesting.",
|
||||
"meta": {
|
||||
"refs": ["https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/", "https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/"],
|
||||
"synonyms": ["Floki Bot"]
|
||||
"refs": [
|
||||
"https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/",
|
||||
"https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/"
|
||||
],
|
||||
"synonyms": [
|
||||
"Floki Bot"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "ZeroT",
|
||||
"description": "Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus. Since the summer of 2016, this group began using a new downloader known as ZeroT to install the PlugX remote access Trojan (RAT) and added Microsoft Compiled HTML Help (.chm) as one of the initial droppers delivered in spear-phishing emails.",
|
||||
"meta": {
|
||||
"refs": ["https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"]
|
||||
"refs": [
|
||||
"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"value": "StreamEx",
|
||||
"description": "Cylance dubbed this family of malware StreamEx, based upon a common exported function used across all samples ‘stream’, combined with the dropper functionality to append ‘ex’ to the DLL file name. The StreamEx family has the ability to access and modify the user’s file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands. The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild. ",
|
||||
"meta": {
|
||||
"refs": ["https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"]
|
||||
"refs": [
|
||||
"https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"version": 19,
|
||||
"version": 21,
|
||||
"uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
|
||||
"description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
|
||||
"author": [
|
||||
"authors": [
|
||||
"Alexandre Dulaunoy",
|
||||
"Florian Roth",
|
||||
"Timo Steffens",
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@ set -x
|
|||
|
||||
# Seeds sponge, from moreutils
|
||||
|
||||
for dir in galaxies/*.json
|
||||
for dir in clusters/*.json
|
||||
do
|
||||
cat ${dir} | jq . | sponge ${dir}
|
||||
done
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ if ! [ $diffs -eq 0 ]; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
for dir in galaxies/*.json
|
||||
for dir in clusters/*.json
|
||||
do
|
||||
echo -n "${dir}: "
|
||||
jsonschema -i ${dir} schema.json
|
||||
|
|
|
|||
Loading…
Reference in a new issue