Rony
ed351b4eae
updated FIN4
2019-05-01 15:24:59 +05:30
Rony
292df2360a
more report on APT36
2019-04-22 11:05:21 +05:30
Deborah Servili
8ac7aec85c
add Sea Turtle campaign
2019-04-19 13:21:11 +02:00
Christophe Vandeplas
ecc63cf166
chg; [threat-actor] validate + version bump
2019-04-17 21:01:55 +02:00
Christophe Vandeplas
d5fd896bb0
Merge pull request #385 from bartblaze/master
...
Add Whitefly
2019-04-17 20:53:15 +02:00
Bart
e1cab68683
Add Whitefly
2019-04-17 12:27:18 +01:00
Rony
d98aefa186
fixed the broken link
2019-04-17 09:17:23 +05:30
Bart
3256cca9e0
Add DoNot team references
2019-04-12 21:12:16 +01:00
d7b4908aa3
Merge branch 'patch-8' of https://github.com/danielplohmann/misp-galaxy into danielplohmann-patch-8
2019-04-12 05:58:47 +02:00
Daniel Plohmann
159225b6cf
Based on additional research, APT36 can actually be merged into Mythic Leopard
2019-04-11 22:29:49 +02:00
Rony
7987c8f023
Update threat-actor.json
2019-04-12 01:56:12 +05:30
Rony
2fc914b2f9
Update threat-actor.json
2019-04-12 01:06:50 +05:30
Rony
60e4a486a7
adding additional resources for APT36
2019-04-11 23:55:51 +05:30
Daniel Plohmann
df5301eab5
adding FireEye's TMP.Lapis / APT36
2019-04-09 08:38:44 +02:00
ac6276a906
Merge pull request #371 from Delta-Sierra/master
...
Add Operation ShadowHammer
2019-03-26 22:25:22 +01:00
Deborah Servili
6027d546f2
Add Operation ShadowHammer
2019-03-26 10:40:29 +01:00
52f088efc9
Merge branch 'master' of https://github.com/Delta-Sierra/misp-galaxy into Delta-Sierra-master
2019-03-21 20:51:59 +01:00
Daniel Plohmann
e0bb3d76a6
added APT-C-27 / GoldMouse
2019-03-21 18:06:03 +01:00
Deborah Servili
d0383b460f
jq
2019-03-21 09:15:16 +01:00
Deborah Servili
0fd04fa619
Merge branch 'master' into master
2019-03-21 08:42:30 +01:00
Deborah Servili
f86c748b8c
add AOT-C-27 Goldmouse
2019-03-20 15:45:20 +01:00
b2538a1f8a
chg: [threat-actor] change attribution confidence to be a string by default
2019-03-19 16:51:41 +01:00
4f454493b7
chg: [threat-actor] BRONZE UNION is also uppercase
2019-03-19 14:47:03 +01:00
9a6b597387
chg: [threat-actor] updated the version to avoid the past issue with 0 value for integer values
2019-03-19 14:44:49 +01:00
Deborah Servili
5ce8aae89e
add Operation Comando - hit version 100
2019-03-15 15:04:29 +01:00
5db30ba974
chg: [threat-actor] SandCat added
2019-03-14 06:18:10 +01:00
Deborah Servili
ecf76178e7
add attribution-confidence attribute to threat-actor
2019-03-11 11:18:12 +01:00
Deborah Servili
a65688ec02
Merge branch 'master' of https://github.com/Delta-Sierra/misp-galaxy
2019-03-11 08:51:47 +01:00
Deborah Servili
33dbda1e1e
Merge branch 'master' of https://github.com/MISP/misp-galaxy
2019-03-11 08:51:16 +01:00
Deborah Servili
59ee8a9f13
Merge branch 'master' into master
2019-03-11 08:40:38 +01:00
Deborah Servili
ddab5f7006
Merge branch 'master' into master
2019-03-11 08:40:11 +01:00
139e6c32ed
chg: [threat-actor] new attribution-confidence level introduced
2019-03-11 08:37:49 +01:00
eb665e2883
chg: [threat-actor] jq all the things
2019-03-10 11:15:13 +01:00
6fb1303570
chg: [threat-actor] IRIDIUM added
...
Ref: https://resecurity.com/blog/parliament_races/
2019-03-10 10:47:34 +01:00
Daniel Plohmann
1d8ada33a0
Update threat-actor.json
...
another actor described by 360TIC.
2019-03-07 17:50:46 +01:00
Daniel Plohmann
cfb807861a
FireEye upgraded TEMP.Periscope to APT40
2019-03-07 14:34:14 +01:00
Deborah Servili
eb0a33eab6
add operation Kabar Cobra
2019-03-06 15:52:49 +01:00
Deborah Servili
6ffb8dd437
add relation between Lazarus Group and Operation SharpShooter
2019-03-04 12:03:05 +01:00
Deborah Servili
bd3fce00e1
add Razdel
2019-02-25 16:35:06 +01:00
f2159bfaa3
chg: [threat-actor] format fixed
2019-02-22 22:50:42 +01:00
d5df0d1064
chg: [threat-actor] uuid fixed
2019-02-22 22:45:28 +01:00
38283f0f86
chg: [threat-actor] STOLEN PENCIL added
2019-02-22 22:41:06 +01:00
243a6280e0
Merge pull request #350 from bartblaze/master
...
Add more info on Lotus Blossom
2019-02-21 23:39:33 +01:00
Bart
06553bbec2
Add more info on Lotus Blossom
...
Add 2 more references, fix typo - Trend calls it "Esile", not "Eslie" as mistakenly stated by CFR. The backdoor itself is commonly referred to as Elise.
2019-02-21 22:31:14 +00:00
ed132cb1b8
chg: [threat-actor] version fixed
2019-02-21 07:18:16 +01:00
Daniel Plohmann
0cd79994cc
Two more actor names from GTR2019
...
I found two more actor names while going again over the crowdstrike's report and updating the cross-references to malpedia.
2019-02-19 22:38:11 +01:00
Daniel Plohmann
85ec27b4c4
Added missing actors from CrowdStrike GTR2019
2019-02-19 18:26:01 +01:00
Itay Cohen
7d9dc1ec9d
Fix 404'd reference of BuhTrap
2019-02-17 11:33:11 +02:00
Deborah Servili
5bf18ffd23
Merge branch 'master' into master
2019-02-14 16:29:04 +01:00
Deborah Servili
9c450a80d4
add Gallmaker and other clusters
2019-02-14 16:04:54 +01:00
Deborah Servili
2794a20589
add OSX/Shlayer and some refs
2019-02-14 12:42:28 +01:00
Deborah Servili
8aeed60a24
Add Siesta campaign
2019-02-11 16:30:46 +01:00
João Neto
662cc5a012
Updated "Iran" name
...
This extra space leads to an unnecessary key error when parsing the json file
2019-02-08 16:50:22 +01:00
Nils Kuhnert
fc16f4f69c
Added Velvet Chollima as synonym to Kimsuki
2019-02-08 08:50:05 +01:00
Christophe Vandeplas
e5f74c8fdc
Merge pull request #336 from 3c7/synonym/static-kitten
...
Added static kitten as synonym for MuddyWater
2019-02-07 08:54:49 +01:00
2bbb8a6a43
Merge pull request #334 from 3c7/synonym/cobalt-spider
...
Added Cobalt Spider as Synonym for Cobalt
2019-02-07 08:53:19 +01:00
Nils Kuhnert
9778bea81e
Added Cobalt Spider reference
2019-02-07 08:41:00 +01:00
Nils Kuhnert
523a52c4db
Added static kitten as synonym for MuddyWater
2019-02-07 08:38:52 +01:00
Nils Kuhnert
0049acd81c
Added Turbine Panda as synonym for APT 26
2019-02-07 08:28:48 +01:00
Nils Kuhnert
5a077cf838
Added Cobalt Spider as Synonym for Cobalt
2019-02-07 08:26:10 +01:00
Nils Kuhnert
a171d5aa9d
Added Ocean Buffalo synonym for Ocean Lotus
2019-02-03 21:36:21 +01:00
b9f1317941
Merge pull request #332 from Delta-Sierra/master
...
Add APT39 & LockerGoga
2019-02-01 18:36:12 +01:00
Nils Kuhnert
0b04046d91
Added Quilted Tiger as Synonym for Patchwork/Dropping Elephant.
2019-02-01 13:17:43 +01:00
Deborah Servili
233b7f3aff
add APT39
2019-01-31 18:48:19 +01:00
Nils Kuhnert
d45a32e9e2
Added Shadow Crane as synonym for Dark Hotel.
2019-01-30 08:22:46 +01:00
Nils Kuhnert
42ecbd801c
Added "Stardust Chollima" as synonym for Lazarus.
2019-01-29 08:36:12 +01:00
898bdaf7f8
Merge pull request #328 from Delta-Sierra/master
...
add Silence Group
2019-01-25 16:43:08 +01:00
Deborah Servili
c11a31b12a
add Silence Group
2019-01-25 16:19:51 +01:00
Thomas Dupuy
d38fb407ec
add alternative name for DarkHydrus
2019-01-21 23:14:34 -05:00
Deborah Servili
3bdbd6646b
add Cold River Threat actor
2019-01-17 09:44:09 +01:00
Deborah Servili
5d61a75886
fix versions
2019-01-14 16:34:28 +01:00
Deborah Servili
61093f6f07
add several ransomware and threat actors
2019-01-14 16:28:15 +01:00
Deborah Servili
90d2bf7bc1
add drakhydrus ref
2019-01-11 10:17:07 +01:00
Deborah Servili
cddfd5fcd1
TA505 threat actorand affiliates malwares
2019-01-11 09:53:08 +01:00
Nils Kuhnert
1e4ebdd560
Added OilRig synonym "Helix Kitten".
2018-12-27 09:10:21 +01:00
Daniel Plohmann
cc22da1200
Microsoft alias for apt29 is YTTRIUM
2018-12-19 11:28:44 +01:00
Daniel Plohmann
c9e15b0c08
new name SNAKEMACKEREL for APT28 by Accenture
2018-12-19 10:46:58 +01:00
Deborah Servili
cb4345adf9
add operation sharpshooter
2018-12-13 13:47:54 +01:00
Deborah Servili
70d68a312c
add some clusters or info
2018-12-12 15:26:54 +01:00
Deborah Servili
169d69871a
add Goden Chickens and affiliates
2018-12-12 13:52:55 +01:00
Deborah Servili
bf77e1125a
add Operation Poison Needles
2018-12-07 16:32:09 +01:00
Deborah Servili
79828d7411
add clusters
2018-12-07 13:25:56 +01:00
Deborah Servili
5a725e71ef
add several clusters
2018-12-06 16:13:51 +01:00
Deborah Servili
be9b4ff40f
add DNSpionage cluster
2018-11-29 16:38:06 +01:00
Deborah Servili
b50c8bd805
add PNG Dropper
2018-11-23 10:38:36 +01:00
Deborah Servili
2bf5d46cc4
Merge branch 'master' of https://github.com/Delta-Sierra/misp-galaxy
2018-11-22 08:59:53 +01:00
Deborah Servili
2f5031b845
add several references for Emotet and others
2018-11-22 08:37:45 +01:00
Deborah Servili
de38e7249c
Merge branch 'master' into master
2018-11-19 15:23:45 +01:00
Deborah Servili
ce61b2d2dd
update oilrig related clusters + others
2018-11-19 14:56:13 +01:00
c9fd60d14b
chg: [threat-actor] INDRIK SPIDER added
2018-11-14 20:46:06 +01:00
Deborah Servili
ca33f1c2ce
Merge branch 'master' of https://github.com/MISP/misp-galaxy
2018-11-13 15:25:34 +01:00
Deborah Servili
f55277b682
add several rqansomware and HookAds campaign
2018-11-13 12:20:37 +01:00
a4c916c916
Merge branch 'master' of github.com:MISP/misp-galaxy
2018-11-13 07:01:56 +01:00
Benoit Sevens
8f8c69134e
Update threat-actor.json
...
Add LuckyMouse link
2018-11-12 13:12:14 +01:00
Deborah Servili
14444e4321
add several tools and refs
2018-11-08 10:39:32 +01:00
Daniel Plohmann
1f6b606f75
added APT38 as (FireEye) alias for Lazarus
...
cross-references in https://content.fireeye.com/apt/rpt-apt38 suggest the link to Lazarus.
2018-11-07 17:19:50 +01:00
2465235817
Merge pull request #293 from Delta-Sierra/master
...
add Operation EvilTraffic
2018-10-30 21:02:59 +01:00
Deborah Servili
e6b1eec329
add Chalubo botnet (+ jqallthethings)
2018-10-30 14:39:13 +01:00
Deborah Servili
41942d0daf
add Operation EvilTraffic
2018-10-30 13:28:46 +01:00
Deborah Servili
74ff4b957a
add Operation EvilTraffic
2018-10-30 13:28:27 +01:00
Nils Kuhnert
bc0bf1ca9f
Corrected DarkHotel threat actor entry
2018-10-29 09:03:30 +01:00
Deborah Servili
af6020077e
add August Stealer
2018-10-23 15:25:37 +02:00
Deborah Servili
bd68ee280e
Merge branch 'master' of https://github.com/MISP/misp-galaxy
2018-10-22 11:09:37 +02:00
Deborah Servili
4564c5eb37
add DarkPulsar and affiliates + update some refs
2018-10-22 10:14:30 +02:00
Christophe Vandeplas
9dddc4427c
jq
2018-10-19 10:23:09 +02:00
Christophe Vandeplas
ddccac58c8
chg: categorization of galaxies
...
This allows relationships to be created.
2018-10-19 10:18:14 +02:00
Christophe Vandeplas
2b24efb14a
fix: add missing relations from commit b857be9cab
2018-10-17 19:15:57 +02:00
Christophe Vandeplas
873bc873b4
Merge remote-tracking branch 'MISP/master'
2018-10-17 18:28:44 +02:00
Christophe Vandeplas
1e90cac717
fix: intrusion is an actor and not a tool
2018-10-17 18:17:33 +02:00
Deborah Servili
c8cbb609a2
add GreyEnergy
2018-10-17 16:05:51 +02:00
Deborah Servili
2ea560f9a7
add refs & synonyms
2018-10-15 12:02:21 +02:00
Deborah Servili
11a27df82d
add roaming mantis group
2018-10-12 15:50:52 +02:00
Deborah Servili
b3109f6aea
Merge branch 'master' of https://github.com/MISP/misp-galaxy
2018-10-12 13:55:01 +02:00
Christophe Vandeplas
f26a4f2806
fix: minor newline difference after jq_all_the
2018-10-12 12:31:29 +02:00
Christophe Vandeplas
f14d616e22
chg: magical mapping with malpedia
2018-10-12 11:00:00 +02:00
Christophe Vandeplas
2fbd8ce485
jq sort keys
...
Allows automation to edit the files
2018-10-12 10:35:31 +02:00
Deborah Servili
4c367737ac
add magecart ref
2018-10-10 14:52:16 +02:00
Deborah Servili
5bcf34a953
update regarding https://twitter.com/adulau/status/1047764090410737664
2018-10-04 10:28:22 +02:00
Deborah Servili
c78416eee1
update synonyms & attributions
2018-10-04 10:09:34 +02:00
Deborah Servili
3dfe8a5a34
add FASTCash
2018-10-03 15:09:14 +02:00
Deborah Servili
403f162451
add ref for magecart
2018-10-01 11:54:07 +02:00
Deborah Servili
35582f7ed5
new threat actors & tools
2018-10-01 11:52:40 +02:00
49fe210812
Merge pull request #270 from Delta-Sierra/master
...
new clusters, relations and information
2018-09-28 12:57:13 +02:00
Deborah Servili
fbf21487cf
new clusters and informtion
2018-09-28 11:08:21 +02:00
Nex
014aa325b7
Added missing country values
2018-09-26 23:05:46 +02:00
Deborah Servili
f7e10cb38d
add references
2018-09-24 14:58:21 +02:00
Deborah Servili
2bc8e1e719
add Cobalt Dickensthreat actor
2018-09-24 11:51:09 +02:00
Deborah Servili
5a1734f170
update version
2018-09-21 11:16:36 +02:00
Deborah Servili
3c7e367cbf
fix field mistake
2018-09-21 11:14:19 +02:00
Deborah Servili
1cee9d71e0
update Lazarus group cluster
2018-09-20 15:38:32 +02:00
Deborah Servili
6d43d52731
new unnamedthreat actor
2018-09-20 13:24:11 +02:00
Deborah Servili
d0864a6531
new threat actors
2018-09-20 12:10:20 +02:00
Deborah Servili
0a724bee3d
merge
2018-09-19 16:01:46 +02:00
Deborah Servili
058f778e61
add references
2018-09-19 09:04:04 +02:00
79146b9d10
fix: array in synonyms (MISP accepts it but not the schema ;-)
2018-09-19 07:35:35 +02:00
6105522453
chg: [threat-actor] Iron Group added
...
ref: https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/
2018-09-19 07:08:16 +02:00
8238bd5eb1
Merge pull request #263 from botherder/bahamut
...
Added Bahamut to threat actors list
2018-09-19 06:46:26 +02:00
Nex
f0383758fc
Added Bahamut to threat actors list
2018-09-18 11:27:32 +02:00
fe60e58f5b
Merge pull request #262 from botherder/mythic-leopard
...
Added additional name to C-Major
2018-09-18 11:25:58 +02:00
Nex
1e502a494e
Added additional name to C-Major
2018-09-18 11:18:42 +02:00
Nex
ee7f609397
Removed duplicates
2018-09-18 11:16:00 +02:00
88c9d8d9f6
Merge pull request #259 from botherder/country-sync
...
Synced country codes with suspected state sponsor
2018-09-17 18:18:00 +02:00
Nex
be0dd94c90
Synced country codes with suspected state sponsor
2018-09-17 16:26:14 +02:00
Nex
c2ea505459
Merged Transparent Tribe in C-Major
2018-09-17 16:11:18 +02:00
Deborah Servili
a73424139f
fix versions
2018-09-12 14:26:44 +02:00
Deborah Servili
f107563cad
add ref for operation Applejeus
2018-09-12 09:34:16 +02:00
Deborah Servili
c92dc15937
add Operation AppleJeus
2018-09-10 14:13:09 +02:00
Deborah Servili
40d5cca20f
clusters
2018-09-07 16:03:40 +02:00
Deborah Servili
f14dd27315
add cfr data
2018-08-27 15:29:16 +02:00
Deborah Servili
9efca2fd79
more clusters
...
Signed-off-by: Deborah Servili <deborah.servili@gmail.com>
2018-08-24 16:11:16 +02:00
Deborah Servili
c943d1c9d1
add APT28/STRONTIUM refs
2018-08-22 09:59:40 +02:00
cd76f19f52
chg: [threat-actor] APT-C-35 actor added
...
ref: https://ti.360.net/blog/articles/latest-activity-of-apt-c-35/
2018-08-15 20:25:57 +02:00
Christophe Vandeplas
88162aa44e
chg: [mapping] Generated automatic mapping between clusters
2018-08-14 09:35:22 +02:00
Christophe Vandeplas
5478f0aa45
no change: dump files with sort_keys=True
...
This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 17:06:29 +02:00
Christophe Vandeplas
021107e597
fix: [threat-actor] added missing uuids
2018-08-13 17:00:40 +02:00
6620b5575a
fix: [threat-actor] related is an array of JSON objects
2018-08-09 07:53:42 +02:00
1429b60555
chg: [threat-actor] jq document
2018-08-08 16:38:39 +02:00
Deborah Servili
ebc7287e14
update schema
2018-08-08 16:12:29 +02:00
Deborah Servili
33a300b773
tags is an array
2018-08-08 15:59:44 +02:00
Deborah Servili
b857be9cab
relationship system - v2
2018-08-08 15:51:22 +02:00
Deborah Servili
050a864be0
update some clusters and try to add a relationship system
2018-08-08 14:20:38 +02:00
Deborah Servili
84adb50f0f
add RedAlpha campaigns
2018-08-07 13:55:05 +02:00
Deborah Servili
b7de06ffcc
delete forgotten conflict marker
2018-08-06 08:49:44 +02:00
Deborah Servili
010df0a2b6
resolve merge conflict
2018-08-06 08:48:21 +02:00
Deborah Servili
def23775e5
resolve merge conflict
2018-08-06 08:45:03 +02:00
Nils Kuhnert
ab49b58b02
Added DarkHydrus
2018-08-06 08:33:34 +02:00
Nils Kuhnert
4654f51889
Two small typos
2018-08-05 15:09:38 +02:00
Deborah Servili
e5b185deee
Merge branch 'master' into master
2018-08-03 16:11:16 +02:00
Deborah Servili
35aa8ba34e
delete duplicate gorgon group
2018-08-03 16:08:43 +02:00
Deborah Servili
a9a71ef84c
more clusters
2018-08-03 15:58:54 +02:00
b3701b6b34
chg: [threat-actor] The Gordon Group added
...
ref: https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/
2018-08-03 10:26:52 +02:00
3da005a3f3
fix: jq all the things(tm)
2018-08-02 15:15:47 +02:00
1fdf47d509
fix: [threat-actor] synonyms are always arraus
2018-08-02 15:13:18 +02:00
ece56dff38
chg: [threat-actor] leafminer - RASPITE added
2018-08-02 15:08:39 +02:00
43fa95df7a
chg: [threat-actor] new reference to CARBON SPIDER/Carbanak
2018-08-02 10:03:18 +02:00
Deborah Servili
381f7e4a19
Add CFR.org metadata into the galaxy - part 2
2018-07-25 09:08:16 +02:00
Deborah Servili
28456545be
Merge https://github.com/MISP/misp-galaxy
2018-07-16 09:16:13 +02:00
98db303047
chg: [threat-actor] The Big Bang campaign/group added
2018-07-10 08:49:00 +02:00
Deborah Servili
cae0f7e1ad
merging attempt
2018-06-29 16:39:34 +02:00
Deborah Servili
8c51ef98b3
add cfr related informations -still in progress-
2018-06-29 16:36:58 +02:00
Deborah Servili
fb6b01cc95
Merge branch 'master' into master
2018-06-27 09:39:28 +02:00
Deborah Servili
b1aac6b35b
cfr update -in progress + add clusters associated to RANCOR
2018-06-27 09:37:43 +02:00
1bd0fb34d7
Merge pull request #233 from Delta-Sierra/master
...
Add CFR.org metadata into the galaxy - Test
2018-06-26 14:26:18 +02:00
Deborah Servili
6f9e639981
add cfr prefix for cfr data - test
2018-06-26 10:07:14 +02:00
Deborah Servili
1cd6bddf0c
Add CFR.org metadata into the galaxy - Test
2018-06-26 09:40:13 +02:00
Nils Kuhnert
ed26cfb042
Updated APT1 report link
2018-06-22 13:49:05 +02:00
8e014674af
Fixed typo
2018-06-20 09:45:16 +02:00
Deborah Servili
dcda058944
update verion
2018-06-20 09:36:36 +02:00
Deborah Servili
e18fdf42da
add Thrip as threat actor
2018-06-20 09:30:15 +02:00
Deborah Servili
d8c83cf2d6
add cluster in threat actor
2018-06-18 10:54:58 +02:00
c08c6af936
chg: Stalker Panda description added
2018-05-29 21:47:04 +02:00
Raphaël Vinot
96f3bf1cb8
fix: Duplicate ELECTRUM entry
...
Fix #212
2018-05-19 17:57:51 -04:00
3a7c4e3c57
Merge pull request #211 from eCrimeLabs/master
...
Added links in relation to Threat-actor info from Dragos
2018-05-15 16:17:56 +02:00
Dennis Rand
1ab4e4f4cf
Added data related to Dragos Adverseries
2018-05-15 12:06:48 +00:00
Deborah Servili
5e0bd260d6
update some clusters
2018-05-09 16:12:02 +02:00
Deborah Servili
58e3e5f5d6
add ZooPark campaign
2018-05-04 10:16:01 +02:00
6b1d7d2201
add: threat actors from Dragos Inc. (based on https://dragos.com/adversaries.html )
2018-05-03 21:22:09 +02:00
Deborah Servili
55504f93d6
add HOGFISH as APT10 synonym
2018-05-03 11:10:21 +02:00
Deborah Servili
11f0963468
add Orangeworm, Kwampirs, Iron ransomware and Ton ransomware
2018-04-24 10:20:11 +02:00
Deborah Servili
c785ee6384
add some ransomwares & threat actors
2018-04-16 09:24:11 +02:00