813 commits

Author	SHA1	Message	Date
Deborah Servili	1cee9d71e0	update Lazarus group cluster	2018-09-20 15:38:32 +02:00
Deborah Servili	6d43d52731	new unnamedthreat actor	2018-09-20 13:24:11 +02:00
Deborah Servili	d0864a6531	new threat actors	2018-09-20 12:10:20 +02:00
Deborah Servili	0a724bee3d	merge	2018-09-19 16:01:46 +02:00
Deborah Servili	3f22dbd17d	add notpetya and update jadeRAT	2018-09-19 15:06:43 +02:00
Deborah Servili	058f778e61	add references	2018-09-19 09:04:04 +02:00
Alexandre Dulaunoy	79146b9d10	fix: array in synonyms (MISP accepts it but not the schema ;-)	2018-09-19 07:35:35 +02:00
Alexandre Dulaunoy	6105522453	chg: [threat-actor] Iron Group added ... ref: https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/	2018-09-19 07:08:16 +02:00
Alexandre Dulaunoy	4ae0ccd192	chg: [tool] Xbash added ... ref: https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/	2018-09-19 07:03:56 +02:00
Alexandre Dulaunoy	8238bd5eb1	Merge pull request #263 from botherder/bahamut ... Added Bahamut to threat actors list	2018-09-19 06:46:26 +02:00
Deborah Servili	fd960bfc1b	Add magentocore malware	2018-09-18 23:10:33 +02:00
Nex	f0383758fc	Added Bahamut to threat actors list	2018-09-18 11:27:32 +02:00
Alexandre Dulaunoy	fe60e58f5b	Merge pull request #262 from botherder/mythic-leopard ... Added additional name to C-Major	2018-09-18 11:25:58 +02:00
Nex	1e502a494e	Added additional name to C-Major	2018-09-18 11:18:42 +02:00
Nex	ee7f609397	Removed duplicates	2018-09-18 11:16:00 +02:00
Alexandre Dulaunoy	88c9d8d9f6	Merge pull request #259 from botherder/country-sync ... Synced country codes with suspected state sponsor	2018-09-17 18:18:00 +02:00
Nex	be0dd94c90	Synced country codes with suspected state sponsor	2018-09-17 16:26:14 +02:00
Nex	c2ea505459	Merged Transparent Tribe in C-Major	2018-09-17 16:11:18 +02:00
Deborah Servili	ff9409e164	add blacknurse logo	2018-09-13 12:42:01 +02:00
Deborah Servili	1dcf2e50a7	add blacknurse	2018-09-13 12:33:19 +02:00
Deborah Servili	17d3959445	add Crypt0saur ransomware	2018-09-13 11:34:57 +02:00
Deborah Servili	0843fdfb23	adding and updating clusters	2018-09-13 09:03:41 +02:00
Deborah Servili	039fc91bd6	add description for sigma ransomware	2018-09-12 14:27:09 +02:00
Deborah Servili	a73424139f	fix versions	2018-09-12 14:26:44 +02:00
Deborah Servili	f107563cad	add ref for operation Applejeus	2018-09-12 09:34:16 +02:00
Deborah Servili	cb5fa5e822	fix version	2018-09-10 14:21:14 +02:00
Deborah Servili	c92dc15937	add Operation AppleJeus	2018-09-10 14:13:09 +02:00
Deborah Servili	a81bbe288f	fix some relations	2018-09-10 12:27:40 +02:00
Deborah Servili	40d5cca20f	clusters	2018-09-07 16:03:40 +02:00
Deborah Servili	addda6c545	more clusters~	2018-09-05 16:39:33 +02:00
Deborah Servili	14024efbf1	add CamuBot Banker Trojan	2018-09-05 09:19:35 +02:00
Deborah Servili	5866b660c8	jq~	2018-09-05 08:29:08 +02:00
Deborah Servili	fb328b0ef4	add ransomwares	2018-09-05 08:20:24 +02:00
Deborah Servili	0a9e91766b	Merge branch 'master' of https://github.com/MISP/misp-galaxy	2018-09-04 10:18:07 +02:00
Deborah Servili	912e91a5f5	add ransomware	2018-09-04 09:43:58 +02:00
Alexandre Dulaunoy	0acc41131d	"jq all the thing (tm)"	2018-09-01 11:58:52 +02:00
Alexandre Dulaunoy	e55f91b7ac	Merge branch 'master' of https://github.com/Kafeine/misp-galaxy into Kafeine-master	2018-09-01 11:56:10 +02:00
Kafeine	ac94f367b1	+ Fallout	2018-09-01 10:07:46 +02:00
Kafeine	21cf5ec957	Hunter EK > Active	2018-08-30 22:47:00 +02:00
Kafeine	85130f264d	Adding Underminer EK	2018-08-30 17:27:59 +02:00
Kafeine	afa3fb4cfd	Status from Terror, Bingo and Astrum	2018-08-30 17:08:37 +02:00
Kafeine	67e9ef2719	Adapting to modification from Misp repository	2018-08-30 17:04:08 +02:00
Deborah Servili	f14dd27315	add cfr data	2018-08-27 15:29:16 +02:00
Deborah Servili	d1940b6a69	Update microsoft-activity-group.json version	2018-08-27 08:38:22 +02:00
Deborah Servili	9efca2fd79	more clusters ... Signed-off-by: Deborah Servili <deborah.servili@gmail.com>	2018-08-24 16:11:16 +02:00
Deborah Servili	c943d1c9d1	add APT28/STRONTIUM refs	2018-08-22 09:59:40 +02:00
Deborah Servili	afea4ca5e7	Merge branch 'master' of https://github.com/MISP/misp-galaxy	2018-08-22 09:03:26 +02:00
Alexandre Dulaunoy	f8c5640613	chg: [tool] biscuit biscvt tool BISKVIT ... ref: https://www.fortinet.com/blog/threat-research/russian-army-exhibition-decoy-leads-to-new-biskvit-malware.html	2018-08-21 10:48:47 +02:00
Alexandre Dulaunoy	cd76f19f52	chg: [threat-actor] APT-C-35 actor added ... ref: https://ti.360.net/blog/articles/latest-activity-of-apt-c-35/	2018-08-15 20:25:57 +02:00
Deborah Servili	3940964956	update Dharma Ransomware	2018-08-14 15:56:09 +02:00
Deborah Servili	d5f35d94dc	version update	2018-08-14 12:21:50 +02:00
Deborah Servili	f3c02ad195	merge black ruby duplicate (delete the newer)	2018-08-14 12:20:29 +02:00
Deborah Servili	31142b41ac	merge	2018-08-14 12:09:21 +02:00
Deborah Servili	a28c50203e	fix	2018-08-14 12:07:12 +02:00
Deborah Servili	2081dc1627	resolve merge confilct -I hope-	2018-08-14 12:06:42 +02:00
Deborah Servili	4e911b2c17	Merge branch 'master' into master	2018-08-14 11:43:59 +02:00
Deborah Servili	7829e0fab6	fix typo and missing uuid	2018-08-14 11:41:06 +02:00
Deborah Servili	a646a835fe	add Rosenbridge backdoor	2018-08-14 10:09:26 +02:00
Christophe Vandeplas	88162aa44e	chg: [mapping] Generated automatic mapping between clusters	2018-08-14 09:35:22 +02:00
Christophe Vandeplas	5478f0aa45	no change: dump files with sort_keys=True ... This is needed to keep better track of the changes when other tools load and save the json files.	2018-08-13 17:06:29 +02:00
Christophe Vandeplas	021107e597	fix: [threat-actor] added missing uuids	2018-08-13 17:00:40 +02:00
Deborah Servili	b100b0cedd	add KEYPASS ransomware	2018-08-13 15:50:09 +02:00
Deborah Servili	f1dcb05576	Merge pull request #246 from Delta-Sierra/master ... add Skygofree android spyware	2018-08-13 12:28:30 +02:00
Deborah Servili	56fe9eb63c	add Skygofree android spyware	2018-08-13 12:20:16 +02:00
Alexandre Dulaunoy	9059a85eed	chg: [tool] KEYMARBLE malware added ... ref: https://www.us-cert.gov/ncas/analysis-reports/AR18-221A	2018-08-11 16:14:39 +02:00
Deborah Servili	27805ca768	add tools used by SamSam	2018-08-09 15:55:36 +02:00
Deborah Servili	597e7bacb9	add ransomwares	2018-08-09 13:53:04 +02:00
Alexandre Dulaunoy	6620b5575a	fix: [threat-actor] related is an array of JSON objects	2018-08-09 07:53:42 +02:00
Alexandre Dulaunoy	1429b60555	chg: [threat-actor] jq document	2018-08-08 16:38:39 +02:00
Deborah Servili	ebc7287e14	update schema	2018-08-08 16:12:29 +02:00
Deborah Servili	33a300b773	tags is an array	2018-08-08 15:59:44 +02:00
Deborah Servili	b857be9cab	relationship system - v2	2018-08-08 15:51:22 +02:00
Deborah Servili	050a864be0	update some clusters and try to add a relationship system	2018-08-08 14:20:38 +02:00
Deborah Servili	84adb50f0f	add RedAlpha campaigns	2018-08-07 13:55:05 +02:00
Deborah Servili	b7de06ffcc	delete forgotten conflict marker	2018-08-06 08:49:44 +02:00
Deborah Servili	010df0a2b6	resolve merge conflict	2018-08-06 08:48:21 +02:00
Deborah Servili	def23775e5	resolve merge conflict	2018-08-06 08:45:03 +02:00
Nils Kuhnert	ab49b58b02	Added DarkHydrus	2018-08-06 08:33:34 +02:00
Nils Kuhnert	4654f51889	Two small typos	2018-08-05 15:09:38 +02:00
Deborah Servili	e5b185deee	Merge branch 'master' into master	2018-08-03 16:11:16 +02:00
Deborah Servili	35aa8ba34e	delete duplicate gorgon group	2018-08-03 16:08:43 +02:00
Deborah Servili	a9a71ef84c	more clusters	2018-08-03 15:58:54 +02:00
Alexandre Dulaunoy	b3701b6b34	chg: [threat-actor] The Gordon Group added ... ref: https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/	2018-08-03 10:26:52 +02:00
Alexandre Dulaunoy	a0dfdd65ae	chg: [rat] Hallaj PRO Rat added ... ref: https://securelist.com/attacks-on-industrial-enterprises-using-rms-and-teamviewer/87104/ misp-event: 5b63f5e4-bf24-4f46-8340-48fc02de0b81	2018-08-03 08:34:55 +02:00
Alexandre Dulaunoy	3da005a3f3	fix: jq all the things(tm)	2018-08-02 15:15:47 +02:00
Alexandre Dulaunoy	1fdf47d509	fix: [threat-actor] synonyms are always arraus	2018-08-02 15:13:18 +02:00
Alexandre Dulaunoy	ece56dff38	chg: [threat-actor] leafminer - RASPITE added	2018-08-02 15:08:39 +02:00
Alexandre Dulaunoy	c232b3dd5a	chg: [tool] added based on Carbanak tooling description from Crowdstrike ... ref: https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/	2018-08-02 10:30:47 +02:00
Alexandre Dulaunoy	43fa95df7a	chg: [threat-actor] new reference to CARBON SPIDER/Carbanak	2018-08-02 10:03:18 +02:00
Alexandre Dulaunoy	4cf84858e3	chg: [tool] Bisonal malware added (new variant with encryption capabilities)	2018-07-31 15:26:11 +02:00
Deborah Servili	e7d2541929	add Kronos Banking Trojan	2018-07-25 09:46:46 +02:00
Deborah Servili	381f7e4a19	Add CFR.org metadata into the galaxy - part 2	2018-07-25 09:08:16 +02:00
Deborah Servili	28456545be	Merge https://github.com/MISP/misp-galaxy	2018-07-16 09:16:13 +02:00
Alexandre Dulaunoy	98db303047	chg: [threat-actor] The Big Bang campaign/group added	2018-07-10 08:49:00 +02:00
Alexandre Dulaunoy	43a2c7f0ef	chg: [botnet] Xor DDoS added	2018-07-09 14:25:19 +02:00
raw-data	77cfaa8221	[add] new backdoor galaxy and cluster	2018-07-06 20:09:52 +01:00
Raphaël Vinot	e5939e3248	Merge branch 'master' of github.com:MISP/misp-galaxy	2018-07-06 15:25:09 +02:00
Raphaël Vinot	6f7a7921ae	new: Add entries from Bambenek Consulting	2018-07-06 15:25:05 +02:00
raw-data	fa8d0e35f6	[add] x1 new entry in stealer.json - AZORult	2018-07-06 11:00:11 +01:00
Deborah Servili	cae0f7e1ad	merging attempt	2018-06-29 16:39:34 +02:00
Deborah Servili	8c51ef98b3	add cfr related informations -still in progress-	2018-06-29 16:36:58 +02:00
Deborah Servili	fb6b01cc95	Merge branch 'master' into master	2018-06-27 09:39:28 +02:00
Deborah Servili	b1aac6b35b	cfr update -in progress + add clusters associated to RANCOR	2018-06-27 09:37:43 +02:00
Alexandre Dulaunoy	1bd0fb34d7	Merge pull request #233 from Delta-Sierra/master ... Add CFR.org metadata into the galaxy - Test	2018-06-26 14:26:18 +02:00
Deborah Servili	6f9e639981	add cfr prefix for cfr data - test	2018-06-26 10:07:14 +02:00
Deborah Servili	1cd6bddf0c	Add CFR.org metadata into the galaxy - Test	2018-06-26 09:40:13 +02:00
Deborah Servili	3838efb0bb	some updates	2018-06-26 09:26:32 +02:00
raw-data	f649af8ba5	[ADD] x1 new entry in tool.json - Koadic	2018-06-25 15:59:30 +01:00
raw-data	b3dffeb8d4	[ADD] x2 new rat - Sisfader, SocketPlayer	2018-06-25 15:46:42 +01:00
raw-data	0920d13c05	[ADD] banker.json version bump	2018-06-25 15:41:32 +01:00
raw-data	b382425d9c	[ADD] x2 new banker - Backswap, Karius	2018-06-25 15:14:56 +01:00
Nils Kuhnert	ed26cfb042	Updated APT1 report link	2018-06-22 13:49:05 +02:00
Deborah Servili	8ebde0540a	Update cert-eu-govsector.json	2018-06-22 12:50:32 +02:00
Deborah Servili	e088194ea9	fix typo in type	2018-06-22 12:45:39 +02:00
Andras Iklody	8e014674af	Fixed typo	2018-06-20 09:45:16 +02:00
Deborah Servili	dcda058944	update verion	2018-06-20 09:36:36 +02:00
Deborah Servili	e18fdf42da	add Thrip as threat actor	2018-06-20 09:30:15 +02:00
Deborah Servili	dcd159f8ed	add olympic destroyer	2018-06-19 15:26:40 +02:00
Deborah Servili	92cbd29091	add severals ransomware	2018-06-19 13:04:32 +02:00
Deborah Servili	cee83f677e	more clusters	2018-06-18 14:30:51 +02:00
Deborah Servili	d8c83cf2d6	add cluster in threat actor	2018-06-18 10:54:58 +02:00
Deborah Servili	ab577afacd	add ClipboardWalletHijacker	2018-06-18 09:47:03 +02:00
Deborah Servili	333db20791	add MysteryBot in android galaxy	2018-06-18 08:41:52 +02:00
Deborah Servili	397b37dcc8	add some ransomwares	2018-06-15 15:14:42 +02:00
Alexandre Dulaunoy	e6bae7165c	Merge pull request #224 from Delta-Sierra/master ... add some clusters	2018-06-13 12:43:35 +02:00
Deborah Servili	4ac23483b9	add some tools	2018-06-13 11:54:50 +02:00
Deborah Servili	cef7d02622	update version	2018-06-13 11:06:31 +02:00
Deborah Servili	c17a2aa7cc	add some clusters	2018-06-13 10:39:11 +02:00
Christophe Vandeplas	db81051154	minor layout corrections - validate_all	2018-06-12 11:03:09 +02:00
Christophe Vandeplas	d0d54b2751	merge pull request 222	2018-06-12 10:58:08 +02:00
Deborah Servili	508bb081c8	add BabaYaga Malware	2018-06-08 15:54:30 +02:00
Deborah Servili	2b447585b6	add PLEAD	2018-06-08 10:18:41 +02:00
Kafeine	25d21204fb	fix	2018-06-07 10:34:55 +01:00
Kafeine	52f0858ef5	+ Glazunov	2018-06-07 10:31:58 +01:00
Deborah Servili	a96a8a4a13	add sigrun ransomware's ransomnotes	2018-06-07 09:33:08 +02:00
Kafeine	178d5219c7	guuid & + VenomKit	2018-06-06 18:00:25 +01:00
Deborah Servili	e561e3e4f0	add Sigrun ransomwaremeta data	2018-06-06 16:29:24 +02:00
Deborah Servili	e2a25e165d	add Sigrun ransomware	2018-06-06 16:12:31 +02:00
Deborah Servili	07f91bcca4	add another cryptomix variant	2018-06-06 15:44:32 +02:00
Deborah Servili	3e91466aea	add Brambul worm	2018-06-06 15:07:30 +02:00
Deborah Servili	3e10d0957c	add Joanap RAT	2018-06-06 14:34:42 +02:00
Alexandre Dulaunoy	308774755c	add: Iron Backdoor	2018-06-03 18:39:37 +02:00
raw-data	388a2b25b3	[ADD] x2 new info/pwd stealers - Nocturnal Stealer, TeleGrab	2018-06-01 15:59:25 +01:00
raw-data	ba6892408b	[ADD] NavRAT	2018-06-01 15:09:22 +01:00
raw-data	42bb2175e2	[ADD] DanaBot	2018-06-01 15:08:55 +01:00
Alexandre Dulaunoy	6d5b8de216	Merge branch 'master' of github.com:MISP/misp-galaxy	2018-05-29 21:47:59 +02:00
Alexandre Dulaunoy	c08c6af936	chg: Stalker Panda description added	2018-05-29 21:47:04 +02:00
raw-data	8726e0542d	[ADD] VPNFilter in tool.json cluster	2018-05-26 23:49:59 +01:00
raw-data	b0396e5ea2	[ADD] Pontoeb, WICKED and Brain Food into botnet.json cluster	2018-05-24 16:39:24 +01:00
Raphaël Vinot	ca964d9d35	Merge branch 'master' of github.com:MISP/misp-galaxy	2018-05-19 17:58:23 -04:00
Raphaël Vinot	96f3bf1cb8	fix: Duplicate ELECTRUM entry ... Fix #212	2018-05-19 17:57:51 -04:00
Deborah Servili	22cb1618a5	Merge pull request #214 from Delta-Sierra/master ... update mitre galaxies - add external id and killchain	2018-05-19 13:21:18 +02:00
Deborah Servili	6c8edd3f61	jq	2018-05-19 13:09:50 +02:00
Deborah Servili	d82a76c08f	fix scripts for nobile and pre attack attack pattern	2018-05-19 13:09:30 +02:00
Deborah Servili	f6d7291e7a	jq	2018-05-19 12:57:20 +02:00
Deborah Servili	730353f63d	update mitre galaxies - add external id and killchain	2018-05-19 12:56:20 +02:00
Alexandre Dulaunoy	3a7c4e3c57	Merge pull request #211 from eCrimeLabs/master ... Added links in relation to Threat-actor info from Dragos	2018-05-15 16:17:56 +02:00
Alexandre Dulaunoy	9b888f238a	Merge pull request #209 from raw-data/master ... [ADD] RadRAT, ARS VBS Loader and FlawedAmmyy into rat.json cluster	2018-05-15 16:17:18 +02:00
Dennis Rand	1ab4e4f4cf	Added data related to Dragos Adverseries	2018-05-15 12:06:48 +00:00
Deborah Servili	3d5c697761	add Stalinlocker	2018-05-15 12:27:20 +02:00
Deborah Servili	5b22aa7225	add Mettle botnet	2018-05-14 12:00:22 +02:00
raw-data	0ba6233309	[ADD] RadRAT, ARS VBS Loader and FlawedAmmyy into rat.json cluster	2018-05-11 01:15:35 +01:00
Deborah Servili	5e0bd260d6	update some clusters	2018-05-09 16:12:02 +02:00
Deborah Servili	2b16c86687	add maikspy	2018-05-09 09:52:22 +02:00
Deborah Servili	d3f7f7b591	jq~	2018-05-09 09:34:08 +02:00
Deborah Servili	360a4d4556	add reference for HNS botnet	2018-05-09 09:29:23 +02:00
Deborah Servili	0d745f6c93	add HNS bot net & HPE iLO 4 Ransomware/Wiper	2018-05-09 09:22:29 +02:00
Deborah Servili	394950379b	add Kitty malware	2018-05-07 15:27:29 +02:00
Deborah Servili	1c783a1453	update version -oops-	2018-05-07 08:52:15 +02:00
Deborah Servili	9cf976b2c5	update - GandCrab v3	2018-05-07 08:46:31 +02:00
Deborah Servili	d6e4c166c5	add an unnamed ransomware	2018-05-04 15:59:37 +02:00
Deborah Servili	ba631f1b43	add spymaster pro as rat	2018-05-04 15:12:56 +02:00
Deborah Servili	58e3e5f5d6	add ZooPark campaign	2018-05-04 10:16:01 +02:00
Alexandre Dulaunoy	6b1d7d2201	add: threat actors from Dragos Inc. (based on https://dragos.com/adversaries.html)	2018-05-03 21:22:09 +02:00
Deborah Servili	979c784640	jq	2018-05-03 16:08:27 +02:00
Deborah Servili	83581c62b0	add Rubella Macro Builder	2018-05-03 15:38:06 +02:00
Deborah Servili	434716df86	add GravityRAT	2018-05-03 14:35:20 +02:00
Deborah Servili	55504f93d6	add HOGFISH as APT10 synonym	2018-05-03 11:10:21 +02:00
Deborah Servili	9a800ebec1	add Henbox	2018-05-03 10:57:39 +02:00
Deborah Servili	11f0963468	add Orangeworm, Kwampirs, Iron ransomware and Ton ransomware	2018-04-24 10:20:11 +02:00
Deborah Servili	6bf2004bd5	add Muhstik botnet	2018-04-23 09:26:28 +02:00
Stefan Kelm	0b63cb683b	NMCRYPT ransomware	2018-04-20 11:28:02 +02:00
Deborah Servili	f95f7b6057	Merge branch 'master' of https://github.com/Delta-Sierra/misp-galaxy	2018-04-20 10:27:54 +02:00
Deborah Servili	338eb7ab61	jq	2018-04-20 10:26:11 +02:00
Deborah Servili	6e2c0ea809	Update Ransomware galaxy version	2018-04-20 10:18:33 +02:00
Deborah Servili	f87da7a3a6	add Xiaoba	2018-04-20 10:13:52 +02:00
Deborah Servili	0e0c806e9e	Merge https://github.com/MISP/misp-galaxy	2018-04-19 16:04:18 +02:00
Deborah Servili	473bf61fc7	add some ransomwares	2018-04-19 15:00:30 +02:00
Daniel Roethlisberger	8c861848f8	Add Comnie RAT.	2018-04-17 15:49:05 +02:00
StefanKelm	74610731ee	Added 'Chtonic' synonym	2018-04-16 15:37:23 +02:00
StefanKelm	eff4ace398	Remove Chthonic since it's a duplicate (banker.json)	2018-04-16 15:34:59 +02:00
Deborah Servili	c785ee6384	add some ransomwares & threat actors	2018-04-16 09:24:11 +02:00
Deborah Servili	1a18ffb3eb	add Rovnix	2018-04-11 16:30:58 +02:00
Deborah Servili	e4b95abce3	add IcedID reference	2018-04-11 11:59:35 +02:00
Deborah Servili	c773597155	add GoScanSSH tool	2018-04-10 15:56:27 +02:00
Deborah Servili	113599bb24	add LockCrypt ransomware	2018-04-10 15:15:08 +02:00
Deborah Servili	a11bd66cf3	jq	2018-04-10 10:54:58 +02:00
Deborah Servili	ef8b428838	add PUBG ransomware	2018-04-10 10:54:36 +02:00
Deborah Servili	6f3921076a	update matrix ransomware	2018-04-09 15:49:11 +02:00
Deborah Servili	20b1508e4b	update version	2018-04-09 14:59:12 +02:00