MISP/misp-galaxy
6
0
Fork 0
mirror of https://github.com/MISP/misp-galaxy.git synced 2024-11-22 23:07:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[threat-actors] Remove SectorJ04 duplicate

Browse source
This commit is contained in:
Mathieu Beligon 2022-11-02 20:30:40 -07:00
parent 015650c6d7
commit e61733591f
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
clusters/threat-actor.json
View file

@ -6477,7 +6477,9 @@
"https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546", "https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546",
"https://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/", "https://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/",
"https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic", "https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic",
"https://cyberthreat.thalesgroup.com/attackers/ATK103" "https://cyberthreat.thalesgroup.com/attackers/ATK103",
"https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/",
"https://www.tenable.com/blog/cve-2020-1472-advanced-persistent-threat-actors-use-zerologon-vulnerability-in-exploit-chain"
], ],
"synonyms": [ "synonyms": [
"SectorJ04 Group", "SectorJ04 Group",
@ -6485,7 +6487,9 @@
"GOLD TAHOE", "GOLD TAHOE",
"Dudear", "Dudear",
"G0092", "G0092",
"ATK103" "ATK103",
"Hive0065",
"CHIMBORAZO"
] ]
}, },
"uuid": "03c80674-35f8-4fe0-be2b-226ed0fcd69f", "uuid": "03c80674-35f8-4fe0-be2b-226ed0fcd69f",
@ -7492,11 +7496,6 @@
"uuid": "9c124874-042d-48cd-b72b-ccdc51ecbbd6", "uuid": "9c124874-042d-48cd-b72b-ccdc51ecbbd6",
"value": "APT41" "value": "APT41"
}, },
{
"description": "SectorJ04 is a Russian-based cybercrime group that began operating about five years ago and conducted hacking activities for financial profit using malware such as banking trojans and ransomware against national and industrial sectors located across Europe, North America and West Africa.\nIn 2019, the SectorJ04 group expanded its hacking activities to cover various industrial sectors located across Southeast Asia and East Asia, and is changing the pattern of their attacks from targeted attacks to searching for random victims. This report includes details related to the major hacking targets of the SectorJ04 group in 2019, how those targets were hacked, characteristics of their hacking activities this year and recent cases of the SectorJ04 group’s hacking.",
"uuid": "50e25cfb-8b4d-408d-a7c6-bd0672662d39",
"value": "SectorJ04"
},
{ {
"description": "A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers.\nThe group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations, evidence suggests that the attackers gained domain admin-level access.", "description": "A previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers’ customers.\nThe group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations, evidence suggests that the attackers gained domain admin-level access.",
"meta": { "meta": {