From 9924a8875c2b703b7d1a3711c9fa209cd6707831 Mon Sep 17 00:00:00 2001 From: Daniel Plohmann Date: Tue, 13 Jun 2017 13:21:10 +0200 Subject: [PATCH 1/2] added PLATINUM to threat-actor.json (afaik not confirmed as an alias atm) --- clusters/threat-actor.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index d216fbc..0dc856a 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -1555,6 +1555,16 @@ "Sphinx Moth" ] } + }, + { + "value": "PLATINUM", + "description": "PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.", + "meta": { + "refs": [ + "http://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf", + "https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/" + ] + } } ], "name": "Threat actor", @@ -1569,5 +1579,5 @@ ], "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.", "uuid": "7cdff317-a673-4474-84ec-4f1754947823", - "version": 22 + "version": 23 } From ff4f428bc17a795b6167105b7f13f3fecaf8f3df Mon Sep 17 00:00:00 2001 From: Daniel Plohmann Date: Tue, 13 Jun 2017 13:25:16 +0200 Subject: [PATCH 2/2] added ELECTRUM to threat-actor.json (afaik not confirmed as an alias atm) --- clusters/threat-actor.json | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 0dc856a..2dd3745 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -1565,6 +1565,16 @@ "https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/" ] } + }, + { + "value": "ELECTRUM", + "description": "Dragos, Inc. tracks the adversary group behind CRASHOVERRIDE as ELECTRUM and assesses with high confidence through confidential sources that ELECTRUM has direct ties to the Sandworm team. Our intelligence ICS WorldView customers have received a comprehensive report and this industry report will not get into sensitive technical details but instead focus on information needed for defense and impact awareness.", + "meta": { + "refs": [ + "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf", + "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf" + ] + } } ], "name": "Threat actor", @@ -1579,5 +1589,5 @@ ], "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.", "uuid": "7cdff317-a673-4474-84ec-4f1754947823", - "version": 23 + "version": 24 }