MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-30 02:37:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

[threat-actors] Add Bondnet

Browse source
This commit is contained in:
Mathieu4141 2024-06-18 04:51:30 -07:00
parent 93cc634d1c
commit c8e623e84c
1 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
clusters/threat-actor.json
View file

@ -16143,6 +16143,18 @@
}, },
"uuid": "0245113e-cef3-4638-9532-3bf235b07d49", "uuid": "0245113e-cef3-4638-9532-3bf235b07d49",
"value": "TA571" "value": "TA571"
},
{
"description": "Bondnet is a threat actor that deploys backdoors and cryptocurrency miners. They use high-performance bots as C2 servers and configure reverse RDP environments on compromised systems. Bondnet has infected over 15,000 Windows server machines worldwide, primarily targeting Windows Server 2008 R2 systems. The botnet is used for mining cryptocurrencies like Monero, ByteCoin, RieCoin, and ZCash, potentially earning the operator thousands of dollars per day.",
"meta": {
"refs": [
"https://asec.ahnlab.com/en/66662/",
"https://www.akamai.com/blog/security/the-bondnet-army",
"https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/"
]
},
"uuid": "78e8bc1a-0be3-4792-a911-9d4813dd7bc3",
"value": "Bondnet"
} }
], ],
"version": 310 "version": 310