MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 14:57:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[threat-actors] Add CloudSorcerer

Browse source
This commit is contained in:
Mathieu4141 2024-07-08 02:28:35 -07:00
parent f7cb975c54
commit d8e7fbaa79
1 changed files with 10 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
clusters/threat-actor.json
View file

@ -16326,6 +16326,16 @@
},
"uuid": "99ad0cef-c53a-44d5-85d4-5459e59a06d5",
"value": "Boolka"
},
{
"description": "CloudSorcerer is a sophisticated APT targeting Russian government entities, utilizing cloud infrastructure for stealth monitoring and data exfiltration. The malware leverages APIs and authentication tokens to access cloud resources for command and control, with GitHub serving as its initial C2 server. CloudSorcerer operates as separate modules depending on the process it's running in, executing from a single executable and utilizing complex inter-process communication through Windows pipes. The actor behind CloudSorcerer shows similarities to the CloudWizard APT in modus operandi, but the unique code and functionality suggest it is a new threat actor inspired by previous techniques.",
"meta": {
"refs": [
"https://securelist.com/cloudsorcerer-new-apt-cloud-actor/113056/"
]
},
"uuid": "895548a2-e5c7-4a76-8425-19aa077db200",
"value": "CloudSorcerer"
}
],
"version": 312