From 4c367737aca50c8660c194f148b97174af11bd50 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Wed, 10 Oct 2018 14:52:16 +0200 Subject: [PATCH 1/6] add magecart ref --- clusters/threat-actor.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index fb81e28..06d49c5 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -5890,7 +5890,8 @@ "meta": { "refs": [ "https://www.bleepingcomputer.com/news/security/british-airways-fell-victim-to-card-scraping-attack/", - "https://www.bleepingcomputer.com/news/security/feedify-hacked-with-magecart-information-stealing-script/" + "https://www.bleepingcomputer.com/news/security/feedify-hacked-with-magecart-information-stealing-script/", + "https://www.bleepingcomputer.com/news/security/magecart-group-compromises-plugin-used-in-thousands-of-stores-makes-rookie-mistake/" ] }, "uuid": "0768fd50-c547-11e8-9aa5-776183769eab" From 11a27df82db83d1076fd194dc5ff014a8f85cad1 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Fri, 12 Oct 2018 15:50:52 +0200 Subject: [PATCH 2/6] add roaming mantis group --- clusters/threat-actor.json | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 9c93c86..68f0bc2 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -5928,7 +5928,20 @@ ], "uuid": "e38d32a2-c708-11e8-8785-472c4cfccd85", "value": "FASTCash" + }, + { + "description": "According to new research by Kaspersky's GReAT team, the online criminal activities of the Roaming Mantis Group have continued to evolve since they were first discovered in April 2018. As part of their activities, this group hacks into exploitable routers and changes their DNS configuration. This allows the attackers to redirect the router user's traffic to malicious Android apps disguised as Facebook and Chrome or to Apple phishing pages that were used to steal Apple ID credentials.\nRecently, Kaspersky has discovered that this group is testing a new monetization scheme by redirecting iOS users to pages that contain the Coinhive in-browser mining script rather than the normal Apple phishing page. When users are redirected to these pages, they will be shown a blank page in the browser, but their CPU utilization will jump to 90% or higher.", + "meta": { + "refs": [ + "https://www.bleepingcomputer.com/news/security/roaming-mantis-group-testing-coinhive-miner-redirects-on-iphones/" + ], + "synonyms": [ + "Roaming Mantis Group" + ] + }, + "uuid": "b27beb94-ce25-11e8-8e11-2f1a59bd0e91", + "value": "Roaming Mantis" } ], - "version": 70 + "version": 71 } From 8d0c87c830ffeac307ec181f8ac236966ed06b50 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Mon, 15 Oct 2018 11:28:01 +0200 Subject: [PATCH 3/6] add several refs --- clusters/rat.json | 5 +++-- clusters/tool.json | 8 +++++--- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/clusters/rat.json b/clusters/rat.json index 8645936..4a142b0 100644 --- a/clusters/rat.json +++ b/clusters/rat.json @@ -2389,7 +2389,8 @@ "https://blog.fortinet.com/2017/08/15/a-quick-look-at-a-new-konni-rat-variant", "https://www.cylance.com/en_us/blog/threat-spotlight-konni-stealthy-remote-access-trojan.html", "https://vallejo.cc/2017/07/08/analysis-of-new-variant-of-konni-rat/", - "http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html" + "http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html", + "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/" ], "synonyms": [ "KONNI" @@ -3255,5 +3256,5 @@ "value": "NukeSped" } ], - "version": 19 + "version": 20 } diff --git a/clusters/tool.json b/clusters/tool.json index e3b5b0e..b806ce7 100644 --- a/clusters/tool.json +++ b/clusters/tool.json @@ -4921,7 +4921,8 @@ "description": "Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.", "meta": { "refs": [ - "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/" + "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/", + "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/" ] }, "uuid": "9e4fd0d3-9736-421c-b1e1-96c1d3665c80", @@ -5903,7 +5904,8 @@ "description": "DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.", "meta": { "refs": [ - "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf" + "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf", + "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/" ], "synonyms": [ "FE_APT_RAT_DOGCALL", @@ -6995,5 +6997,5 @@ "value": "CoalaBot" } ], - "version": 94 + "version": 95 } From c134035a6d19b2095eb62ba36d49a5b250a8abf6 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Mon, 15 Oct 2018 11:33:37 +0200 Subject: [PATCH 4/6] add several refs --- clusters/tool.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/clusters/tool.json b/clusters/tool.json index b806ce7..3e30385 100644 --- a/clusters/tool.json +++ b/clusters/tool.json @@ -4895,7 +4895,8 @@ "description": "Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. \nThroughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time. In this article, we will analyse this evolution:", "meta": { "refs": [ - "http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html" + "http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html", + "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/" ] }, "related": [ From 2ea560f9a7a0d5dc7022a4ff21b96dd71787ef81 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Mon, 15 Oct 2018 12:02:21 +0200 Subject: [PATCH 5/6] add refs & synonyms --- clusters/threat-actor.json | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 68f0bc2..6f2d28c 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -4933,15 +4933,21 @@ "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf", "http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html", "https://twitter.com/mstoned7/status/966126706107953152", - "https://www.cfr.org/interactive/cyber-operations/apt-37" + "https://www.cfr.org/interactive/cyber-operations/apt-37", + "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/" ], "synonyms": [ "APT 37", "Group 123", + "Group123", "Starcruft", "Reaper", + "Reaper Group", "Red Eyes", - "Ricochet Chollima" + "Ricochet Chollima", + "StarCruft", + "Operation Daybreak", + "Operation Erebus." ] }, "related": [ @@ -5943,5 +5949,5 @@ "value": "Roaming Mantis" } ], - "version": 71 + "version": 72 } From c8cbb609a254d137831fffef898d2a33496c3594 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Wed, 17 Oct 2018 16:05:51 +0200 Subject: [PATCH 6/6] add GreyEnergy --- clusters/threat-actor.json | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 6f2d28c..217c6c1 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -2352,6 +2352,13 @@ "estimative-language:likelihood-probability=\"likely\"" ], "type": "similar" + }, + { + "dest-uuid": "d52ca4c4-d214-11e8-8d29-c3e7cb78acce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" } ], "uuid": "f512de42-f76b-40d2-9923-59e7dbdfec35", @@ -5947,7 +5954,27 @@ }, "uuid": "b27beb94-ce25-11e8-8e11-2f1a59bd0e91", "value": "Roaming Mantis" + }, + { + "description": "ESET research reveals a successor to the infamous BlackEnergy APT group targeting critical infrastructure, quite possibly in preparation for damaging attacks", + "meta": { + "refs": [ + "https://www.eset.com/int/greyenergy-exposed/", + "https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/" + ] + }, + "related": [ + { + "dest-uuid": "f512de42-f76b-40d2-9923-59e7dbdfec35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d52ca4c4-d214-11e8-8d29-c3e7cb78acce", + "value": "GreyEnergy" } ], - "version": 72 + "version": 73 }