MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 00:37:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[threat-actors] Add Tstark

Browse source
This commit is contained in:
Mathieu4141 2024-11-12 06:58:59 -08:00
parent bf1e094875
commit a1277db62c
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
clusters/threat-actor.json
View file

@ -17336,6 +17336,17 @@
},
"uuid": "ca448608-83fa-467d-8637-1cf004fd8e8a",
"value": "FrostyNeighbor"
},
{
"description": "TStark is a threat actor identified by X-Ops, associated with a cluster of devices that executed the bookmark buffer overflow exploit targeting CVE-2020-15069 (T1203). The actor exhibited odd telemetry behavior indicative of intermittent VPN usage, switching between IP addresses geolocated to Hong Kong and Chengdu. Analysis revealed malware samples for Mac OS X and iOS, as well as IFRAME injection code exploiting a WebAssembly vulnerability (T1189). Additionally, TStark was linked to the development of libsophos.so and the deployment of malicious payloads across their devices.",
"meta": {
"country": "CN",
"refs": [
"https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/"
]
},
"uuid": "7c1af433-bde1-4c35-85d3-e951b5020187",
"value": "Tstark"
}
],
"version": 320