MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-23 15:27:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request #286 from Delta-Sierra/master

Browse source 
Several clusters, refs, others.
This commit is contained in:
Alexandre Dulaunoy 2018-10-17 17:32:45 +02:00 committed by GitHub
commit 9129724343
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 61 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
clusters/rat.json
View file

@ -2389,7 +2389,8 @@
"https://blog.fortinet.com/2017/08/15/a-quick-look-at-a-new-konni-rat-variant", "https://blog.fortinet.com/2017/08/15/a-quick-look-at-a-new-konni-rat-variant",
"https://www.cylance.com/en_us/blog/threat-spotlight-konni-stealthy-remote-access-trojan.html", "https://www.cylance.com/en_us/blog/threat-spotlight-konni-stealthy-remote-access-trojan.html",
"https://vallejo.cc/2017/07/08/analysis-of-new-variant-of-konni-rat/", "https://vallejo.cc/2017/07/08/analysis-of-new-variant-of-konni-rat/",
"http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html" "http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html",
"https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
], ],
"synonyms": [ "synonyms": [
"KONNI" "KONNI"
@ -3255,5 +3256,5 @@
"value": "NukeSped" "value": "NukeSped"
} }
], ],
"version": 19 "version": 20
} }

55
clusters/threat-actor.json
View file

@ -2352,6 +2352,13 @@
"estimative-language:likelihood-probability=\"likely\"" "estimative-language:likelihood-probability=\"likely\""
], ],
"type": "similar" "type": "similar"
},
{
"dest-uuid": "d52ca4c4-d214-11e8-8d29-c3e7cb78acce",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
} }
], ],
"uuid": "f512de42-f76b-40d2-9923-59e7dbdfec35", "uuid": "f512de42-f76b-40d2-9923-59e7dbdfec35",
@ -4933,15 +4940,21 @@
"https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf", "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf",
"http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html", "http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html",
"https://twitter.com/mstoned7/status/966126706107953152", "https://twitter.com/mstoned7/status/966126706107953152",
"https://www.cfr.org/interactive/cyber-operations/apt-37" "https://www.cfr.org/interactive/cyber-operations/apt-37",
"https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
], ],
"synonyms": [ "synonyms": [
"APT 37", "APT 37",
"Group 123", "Group 123",
"Group123",
"Starcruft", "Starcruft",
"Reaper", "Reaper",
"Reaper Group",
"Red Eyes", "Red Eyes",
"Ricochet Chollima" "Ricochet Chollima",
"StarCruft",
"Operation Daybreak",
"Operation Erebus."
] ]
}, },
"related": [ "related": [
@ -5898,7 +5911,8 @@
"meta": { "meta": {
"refs": [ "refs": [
"https://www.bleepingcomputer.com/news/security/british-airways-fell-victim-to-card-scraping-attack/", "https://www.bleepingcomputer.com/news/security/british-airways-fell-victim-to-card-scraping-attack/",
"https://www.bleepingcomputer.com/news/security/feedify-hacked-with-magecart-information-stealing-script/" "https://www.bleepingcomputer.com/news/security/feedify-hacked-with-magecart-information-stealing-script/",
"https://www.bleepingcomputer.com/news/security/magecart-group-compromises-plugin-used-in-thousands-of-stores-makes-rookie-mistake/"
] ]
}, },
"uuid": "0768fd50-c547-11e8-9aa5-776183769eab", "uuid": "0768fd50-c547-11e8-9aa5-776183769eab",
@ -5927,7 +5941,40 @@
], ],
"uuid": "e38d32a2-c708-11e8-8785-472c4cfccd85", "uuid": "e38d32a2-c708-11e8-8785-472c4cfccd85",
"value": "FASTCash" "value": "FASTCash"
},
{
"description": "According to new research by Kaspersky's GReAT team, the online criminal activities of the Roaming Mantis Group have continued to evolve since they were first discovered in April 2018. As part of their activities, this group hacks into exploitable routers and changes their DNS configuration. This allows the attackers to redirect the router user's traffic to malicious Android apps disguised as Facebook and Chrome or to Apple phishing pages that were used to steal Apple ID credentials.\nRecently, Kaspersky has discovered that this group is testing a new monetization scheme by redirecting iOS users to pages that contain the Coinhive in-browser mining script rather than the normal Apple phishing page. When users are redirected to these pages, they will be shown a blank page in the browser, but their CPU utilization will jump to 90% or higher.",
"meta": {
"refs": [
"https://www.bleepingcomputer.com/news/security/roaming-mantis-group-testing-coinhive-miner-redirects-on-iphones/"
],
"synonyms": [
"Roaming Mantis Group"
]
},
"uuid": "b27beb94-ce25-11e8-8e11-2f1a59bd0e91",
"value": "Roaming Mantis"
},
{
"description": "ESET research reveals a successor to the infamous BlackEnergy APT group targeting critical infrastructure, quite possibly in preparation for damaging attacks",
"meta": {
"refs": [
"https://www.eset.com/int/greyenergy-exposed/",
"https://www.welivesecurity.com/2018/10/17/greyenergy-updated-arsenal-dangerous-threat-actors/"
]
},
"related": [
{
"dest-uuid": "f512de42-f76b-40d2-9923-59e7dbdfec35",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
} }
], ],
"version": 70 "uuid": "d52ca4c4-d214-11e8-8d29-c3e7cb78acce",
"value": "GreyEnergy"
}
],
"version": 73
} }

11
clusters/tool.json
View file

@ -4895,7 +4895,8 @@
"description": "Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. \nThroughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time. In this article, we will analyse this evolution:", "description": "Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. \nThroughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time. In this article, we will analyse this evolution:",
"meta": { "meta": {
"refs": [ "refs": [
"http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html" "http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html",
"https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
] ]
}, },
"related": [ "related": [
@ -4921,7 +4922,8 @@
"description": "Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.", "description": "Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.",
"meta": { "meta": {
"refs": [ "refs": [
"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/" "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/",
"https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
] ]
}, },
"uuid": "9e4fd0d3-9736-421c-b1e1-96c1d3665c80", "uuid": "9e4fd0d3-9736-421c-b1e1-96c1d3665c80",
@ -5903,7 +5905,8 @@
"description": "DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.", "description": "DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.",
"meta": { "meta": {
"refs": [ "refs": [
"https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf" "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf",
"https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
], ],
"synonyms": [ "synonyms": [
"FE_APT_RAT_DOGCALL", "FE_APT_RAT_DOGCALL",
@ -6995,5 +6998,5 @@
"value": "CoalaBot" "value": "CoalaBot"
} }
], ],
"version": 94 "version": 95
} }