MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-27 01:07:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sauron versus Project Sauron (Kasperksy used both)

Browse source
This commit is contained in:
Alexandre Dulaunoy 2016-09-06 16:16:50 +02:00
parent 8e97ac0cf1
commit a049a08024
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
elements/adversary-groups.json
View file

@ -91,7 +91,8 @@
"Operation Transparent Tribe", "Operation Transparent Tribe",
"Poseidon Group", "Poseidon Group",
"DragonOK", "DragonOK",
"Threat Group-3390" "Threat Group-3390",
"Project Sauron"
], ],
"values": [ "values": [
{ {
@ -903,7 +904,7 @@
}, },
{ {
"value": "ProjectSauron", "value": "ProjectSauron",
"synonyms": ["Strider"], "synonyms": ["Strider", "Sauron"],
"description": "ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods. Technical details show how attackers learned from other extremely advanced actors in order to avoid repeating their mistakes. As such, all artifacts are customized per given target, reducing their value as indicators of compromise for any other victim. Usually APT campaigns have a geographical nexus, aimed at extracting information within a specific region or from a given industry. That usually results in several infections in countries within that region, or in the targeted industry around the world. Interestingly, ProjectSauron seems to be dedicated to just a couple of countries, focused on collecting high value intelligence by compromising almost all key entities it could possibly reach within the target area. The name, ProjectSauron reflects the fact that the code authors refer to ‘Sauron’ in the Lua scripts.", "description": "ProjectSauron is the name for a top level modular cyber-espionage platform, designed to enable and manage long-term campaigns through stealthy survival mechanisms coupled with multiple exfiltration methods. Technical details show how attackers learned from other extremely advanced actors in order to avoid repeating their mistakes. As such, all artifacts are customized per given target, reducing their value as indicators of compromise for any other victim. Usually APT campaigns have a geographical nexus, aimed at extracting information within a specific region or from a given industry. That usually results in several infections in countries within that region, or in the targeted industry around the world. Interestingly, ProjectSauron seems to be dedicated to just a couple of countries, focused on collecting high value intelligence by compromising almost all key entities it could possibly reach within the target area. The name, ProjectSauron reflects the fact that the code authors refer to ‘Sauron’ in the Lua scripts.",
"refs": ["https://securelist.com/analysis/publications/75533/faq-the-projectsauron-apt/"] "refs": ["https://securelist.com/analysis/publications/75533/faq-the-projectsauron-apt/"]
} }