From f5687c0162758811d39104a246f7b68be8298308 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Wed, 31 Jul 2024 02:14:11 -0700 Subject: [PATCH] [threat-actors] Add TA4903 --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index cc9fc27..0602533 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -16455,6 +16455,16 @@ }, "uuid": "02768be6-853c-4239-8fb1-823427489a86", "value": "APT45" + }, + { + "description": "TA4903 is a financially motivated threat actor known for conducting credential phishing and business email compromise campaigns. They target organizations in the U.S. across various sectors, spoofing government entities and private businesses. The actor has been observed using techniques such as QR codes in phishing campaigns and spoofing supplier domains to prompt victims to provide banking information. TA4903's activities typically involve stealing corporate credentials to facilitate follow-on BEC activities.", + "meta": { + "refs": [ + "https://www.proofpoint.com/us/blog/threat-insight/ta4903-actor-spoofs-us-government-small-businesses-phishing-bec-bids" + ] + }, + "uuid": "1725e1c3-9870-4f66-8962-753c4ed3e086", + "value": "TA4903" } ], "version": 312