MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 08:47:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

merge

Browse source
This commit is contained in:
Delta-Sierra 2022-03-07 16:04:38 +01:00
commit a7f3df8a9a
1 changed files with 33 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
clusters/threat-actor.json
View file

@ -4200,6 +4200,12 @@
{ {
"description": "Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.", "description": "Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this threat group the Gamaredon Group and our research shows that the Gamaredon Group has been active since at least 2013. In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities.",
"meta": { "meta": {
"cfr-suspected-victims": [
"Ukraine"
],
"cfr-target-category": [
"Government"
],
"refs": [ "refs": [
"http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution", "http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution",
"https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf", "https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf",
@ -4210,7 +4216,8 @@
"https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/", "https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/",
"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine",
"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/", "https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/",
"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/" "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/",
"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"
], ],
"synonyms": [ "synonyms": [
"Primitive Bear", "Primitive Bear",
@ -8509,11 +8516,14 @@
{ {
"description": "Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.", "description": "Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.",
"meta": { "meta": {
"attribution-confidence": "50",
"cfr-suspected-state-sponsor": "Belarus",
"cfr-suspected-victims": [ "cfr-suspected-victims": [
"Germany", "Germany",
"Latvia", "Latvia",
"Lithuania", "Lithuania",
"Poland" "Poland",
"Ukraine"
], ],
"cfr-target-category": [ "cfr-target-category": [
"Government" "Government"
@ -8521,7 +8531,9 @@
"country": "BY", "country": "BY",
"refs": [ "refs": [
"https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html", "https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html",
"https://twitter.com/hatr/status/1377220336597483520" "https://twitter.com/hatr/status/1377220336597483520",
"https://www.mandiant.com/resources/unc1151-linked-to-belarus-government",
"https://www.bleepingcomputer.com/news/security/meta-ukrainian-officials-military-targeted-by-ghostwriter-hackers/"
], ],
"synonyms": [ "synonyms": [
"UNC1151", "UNC1151",
@ -9085,7 +9097,24 @@
}, },
"uuid": "75fac2e9-8f2c-4620-a1cc-4b8a61c1bb48", "uuid": "75fac2e9-8f2c-4620-a1cc-4b8a61c1bb48",
"value": "TA800" "value": "TA800"
},
{
"description": "Cybereason Nocturnus describes Moses Staff as an Iranian hacker group, first spotted in October 2021. Their motivation appears to be to harm Israeli companies by leaking sensitive, stolen data.",
"meta": {
"country": "IR",
"refs": [
"https://twitter.com/campuscodi/status/1450455259202166799",
"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/",
"https://www.cybereason.com/blog/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations",
"https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard"
],
"synonyms": [
"Moses Staff"
]
},
"uuid": "d45dd940-b38d-4b2c-9f2f-3e4a0eac841c",
"value": "MosesStaff"
} }
], ],
"version": 213 "version": 214
} }