MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 23:07:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge pull request #492 from Delta-Sierra/master

Browse source 
Operation Soft Cell ralated Updates
This commit is contained in:
Alexandre Dulaunoy 2019-12-13 13:35:52 +01:00 committed by GitHub
commit 9f56a91013
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 47 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
clusters/microsoft-activity-group.json
View file

@ -236,7 +236,29 @@
],
"uuid": "2a410eea-a9da-11e8-b404-37b7060746c8",
"value": "https://www.cfr.org/interactive/cyber-operations/mythic-leopard"
},
{
"description": "Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers. When Microsoft customers have been targeted by this activity, we notified them directly with the relevant information they need to protect themselves. By sharing the detailed methodology and indicators related to GALLIUM activity, we’re encouraging the security community to implement active defenses to secure the broader ecosystem from these attacks.\nTo compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss. Once persistence is established in a network, GALLIUM uses common techniques and tools like Mimikatz to obtain credentials that allows for lateral movement across the target network. Within compromised networks, GALLIUM makes no attempt to obfuscate their intent and are known to use common versions of malware and publicly available toolkits with small modifications. The operators rely on low cost and easy to replace infrastructure that consists of dynamic-DNS domains and regularly reused hop points.\nThis activity from GALLIUM has been identified predominantly through 2018 to mid-2019. GALLIUM is still active; however, activity levels have dropped when compared to what was previously observed.",
"meta": {
"refs": [
"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"
],
"synonyms": [
"Operation Soft Cell"
]
},
"related": [
{
"dest-uuid": "8dda51ef-9a30-48f7-b0fd-5b6f0a62262d",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "6085aad0-1d95-11ea-a140-078d42aced40",
"value": "GALLIUM"
}
],
"version": 6
"version": 7
}

25
clusters/threat-actor.json
View file

@ -1156,6 +1156,13 @@
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
},
{
"dest-uuid": "8dda51ef-9a30-48f7-b0fd-5b6f0a62262d",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "suspected-link"
}
],
"uuid": "56b37b05-72e7-4a89-ba8a-61ce45269a8c",
@ -7774,6 +7781,22 @@
"operation"
]
},
"related": [
{
"dest-uuid": "56b37b05-72e7-4a89-ba8a-61ce45269a8c",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "suspected-link"
},
{
"dest-uuid": "6085aad0-1d95-11ea-a140-078d42aced40",
"tags": [
"estimative-language:likelihood-probability=\"likely\""
],
"type": "similar"
}
],
"uuid": "8dda51ef-9a30-48f7-b0fd-5b6f0a62262d",
"value": "Operation Soft Cell"
},
@ -7829,5 +7852,5 @@
"value": "APT-C-34"
}
],
"version": 146
"version": 147
}