MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-26 08:47:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[threat-actors] Add IRLeaks

Browse source
This commit is contained in:
Mathieu4141 2024-09-09 08:18:23 -07:00
parent 4fc5c37d08
commit af9d183371
1 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
clusters/threat-actor.json
View file

@ -16601,6 +16601,20 @@
}, },
"uuid": "8356805a-5612-449c-9fdc-cbe536c1f392", "uuid": "8356805a-5612-449c-9fdc-cbe536c1f392",
"value": "UAC-0154" "value": "UAC-0154"
},
{
"description": "IRLeaks is a threat actor known for significant cyberattacks targeting Iranian organizations, including a major breach of SnappFood, where they exfiltrated 3TB of sensitive data from 20 million user profiles. They have also compromised data from 23 leading Iranian insurance companies, offering over 160 million records for sale. Their operations involve extortion tactics, as seen in the ransom negotiations with Tosan, and they utilize malware such as StealC for data extraction. IRLeaks communicates primarily in Persian and has been active in selling stolen data on cybercriminal marketplaces.",
"meta": {
"refs": [
"https://www.hackread.com/iranian-food-delivery-snappfood-cyber-attack/",
"https://cisoseries.com/cyber-security-headlines-google-5b-suit-settled-orbit-chain-loses-80m-fda-cyber-agreement/",
"https://www.oodaloop.com/briefs/2024/01/04/pilfered-data-from-iranian-insurance-and-food-delivery-firms-leaked-online/",
"https://cybershafarat.com/2024/09/04/major-ir-leaks/",
"https://www.scmagazine.com/brief/significant-ransom-payment-by-major-iranian-it-firm-underway"
]
},
"uuid": "f0a50fa0-25ca-4346-a666-390923f2c5a1",
"value": "IRLeaks"
} }
], ],
"version": 313 "version": 313