Sebdraven
8713618777
Update threat-actor.json
...
add new ref for sidecopy
2023-03-23 09:13:23 +01:00
Sebdraven
f5d68aa08d
Update threat-actor.json
...
delete ref to APT30 for Naikon
2023-03-23 08:49:17 +01:00
Sebdraven
d5843d46e2
Update threat-actor.json
...
add ref to Aoqin Dragon
2023-03-21 18:40:10 +01:00
122a0bd39b
fix: [ransomware] fix duplicate Value "Cuba"
2023-03-19 11:03:12 +01:00
f2305dc165
Merge pull request #829 from Delta-Sierra/main
...
update based on ransomlook+1
2023-03-16 19:18:54 +01:00
Delta-Sierra
12f69a6082
update based on ransomlook
2023-03-16 15:24:44 +01:00
Mathieu Beligon
d82ff1ecfb
[threat-actors] Add Anonymous Sudan
2023-03-15 17:38:03 -05:00
Daniel Plohmann
c39b46e9d5
Update threat-actor.json
...
when value "Sofacy" was changed to "APT28", it seems Sofacy was not added to aliases, so it's missing right now.
2023-03-15 14:55:25 +01:00
Delta-Sierra
74390b27c5
Merge https://github.com/MISP/misp-galaxy
2023-03-13 09:59:04 +01:00
Delta-Sierra
c4eca7dfe1
more from ransomlook
2023-03-13 09:59:00 +01:00
Jürgen Löhel
9f9a263394
chg [tool]: Add tools used by TA866 during the Screentime campaign
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-03-08 21:46:11 -06:00
Jürgen Löhel
031a4c8030
chg [stealer]: Add Rhadamanthys
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-03-08 21:45:39 -06:00
Jürgen Löhel
437d4a30e5
chg [tds]: Add 404 TDS
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-03-08 21:45:13 -06:00
Jürgen Löhel
2d30785af5
chg [threat-actors] Add TA866
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-03-08 21:44:16 -06:00
57f3e46273
chg: [sigma] updated
2023-03-07 12:14:48 +01:00
e7b97edaa4
chg: [ransomware] fixing duplicate cluster element Avaddon
2023-03-07 12:06:56 +01:00
6db5b0b0cb
Merge pull request #824 from Delta-Sierra/main
...
update based on ransomlook
2023-03-06 16:23:48 +01:00
Delta-Sierra
bed6bf8dd6
fix stupid duplicate-bis
2023-03-06 16:10:23 +01:00
Delta-Sierra
d561350f7b
fix stupid duplicate
2023-03-06 16:04:28 +01:00
Delta-Sierra
96cb1e22ba
update based on ransomlook
2023-03-06 15:55:46 +01:00
Mathieu Beligon
395ffda94f
[threat-actors] bump version
2023-03-02 10:29:52 -08:00
Mathieu Beligon
e1407c3c3f
[threat-actors] Add SLIPPY SPIDER alias to LAPSUS
2023-03-02 10:29:29 -08:00
Mathieu Beligon
4bbee8c1e7
[threat-actors] Add PROPHET SPIDER
2023-03-02 10:19:24 -08:00
Mathieu Beligon
61cb24a3fc
[threat-actors] Add Nemesis Kitten
2023-03-01 16:37:42 -08:00
Mathieu Beligon
84faa3c92b
[threat-actors] Add Karakurt
2023-03-01 16:34:03 -08:00
Mathieu Beligon
7d371b4c80
[threat-actors] Add CYBORG SPIDER alias to GOCLD BURLAP
2023-03-01 15:45:41 -08:00
Mathieu Beligon
fa57354471
[threat-actors] Add Chamelgang
2023-03-01 15:40:23 -08:00
Mathieu Beligon
bff978e4d1
[threat-actors] Add TA453
2023-03-01 15:24:55 -08:00
Mathieu Beligon
3406ad3aa9
[threat-actors] Add APT42
2023-03-01 15:18:53 -08:00
Mathieu Beligon
2567d6f1f8
[threat-actors] Add TA406
2023-03-01 15:01:22 -08:00
Rony
50624af741
add DEV-0147 https://twitter.com/MsftSecIntel/status/1625181255754039318
2023-02-25 20:18:09 +00:00
Rony
cf727f034c
add other actor synonyms from Google's report https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf
2023-02-26 01:05:50 +05:30
Delta-Sierra
27f4c9fcdc
synonyms must be an array
2023-02-23 14:26:20 +01:00
Delta-Sierra
0ca7675a5f
Merge https://github.com/MISP/misp-galaxy
2023-02-23 14:16:00 +01:00
Delta-Sierra
55725c771e
add/update ransomware based on ransomlook
2023-02-23 14:15:09 +01:00
Tom King
e52eefa0e7
chg: [mitre] updated with correct ID parsing
2023-02-21 10:36:37 +00:00
Christophe Vandeplas
9f73ff73ac
fix: [first-dns] corrected typo
2023-02-21 10:54:30 +08:00
Christophe Vandeplas
e2f2026fea
chg: [first-dns] Adds FIRST DNS Abuse Techniques Matrix
2023-02-21 10:26:46 +08:00
Christophe Vandeplas
a6a9a73ae5
chg: [360net] updated to latest online version
2023-02-20 20:03:36 +08:00
6460fde2e4
chg: [threat-actor] version updated
2023-02-16 14:43:45 +01:00
Daniel Plohmann
91255413d8
adding Google names for RU threat actors
...
https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/
2023-02-16 14:30:05 +01:00
73bd7d0983
Merge pull request #818 from Mathieu4141/threat-actors/proofpoint-aliases
...
[threat actors] Adding some actors from ProofPoint
2023-02-14 06:40:22 +01:00
Mathieu Beligon
9f09699047
[threat-actors] Fix: country was in the wrong place
2023-02-13 16:47:38 -08:00
Mathieu Beligon
ac067a236e
[threat-actors] fix: Add missing uuids
2023-02-13 16:36:41 -08:00
Mathieu Beligon
a792115dd8
fix
2023-02-13 16:26:10 -08:00
Mathieu Beligon
8193b05e14
[threat-actors] bump version
2023-02-13 14:18:58 -08:00
Mathieu Beligon
d34e894d2d
[threat-actors] Add TA2536
2023-02-13 13:45:41 -08:00
Mathieu Beligon
20c31a5d10
[threat-actors] Add TA577
2023-02-13 13:32:24 -08:00
Mathieu Beligon
e836a4a63c
[threat-actors] Add TA575
2023-02-13 12:02:32 -08:00
Mathieu Beligon
c52ac53765
[threat-actors] Add TA570
2023-02-13 11:54:47 -08:00
Mathieu Beligon
5f274f58c9
[threat-actors] Add Moskalvzapoe
2023-02-13 11:44:59 -08:00
Daniel Plohmann
62256854bc
adding Broadcom name for SaintBear.
2023-02-13 14:05:35 +01:00
Mathieu Beligon
33ff650327
[threat-actors] Add more information about NoName057(16)
2023-02-10 14:14:52 -08:00
9645b9348b
chg: [tools] TgToxic added
2023-02-09 16:24:45 +01:00
o1mate
239883e2a9
Merging the handguns and shotguns clusters into a single firearm cluster.
2023-02-06 03:28:49 -05:00
385826063b
chg: [sigma] updated to the latest version
2023-02-05 11:26:16 +01:00
Daniel Plohmann
9710e09e17
new APT29 name used by Recorded Future
...
cf. https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf
2023-02-02 11:46:50 +01:00
3d6ec1b187
chg: [sigma] updated to the latest version
2023-02-02 11:25:19 +01:00
Jürgen Löhel
cf492d9931
chg: [stealer] Adds Album Stealer
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-02-01 17:30:56 -06:00
033895b052
Merge pull request #812 from jloehel/boldmove
...
chg: [backdoor] Adds BOLDMOVE
2023-01-31 06:24:59 +01:00
Jürgen Löhel
c7c2b8441a
chg: [stealer] Removes BluStealer
...
The BluStealer is already in the malpedia cluster.
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-01-30 18:35:28 -06:00
Jürgen Löhel
ca635cc3fc
chg: [stealer] Adds DarkCloud and BluStealer
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-01-30 18:29:25 -06:00
Jürgen Löhel
33513241bd
chg: [backdoor] Adds BOLDMOVE
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2023-01-30 16:39:11 -06:00
150e3152cc
Merge pull request #809 from MISP/dev
...
Updated the `region` cluster
2023-01-27 15:08:16 +01:00
b7543c5012
Merge pull request #789 from Mathieu4141/threat-actors/fix-sectorj04
...
[threat-actors] Remove SectorJ04 duplicate
2023-01-27 15:05:37 +01:00
Mathieu Beligon
a452263ace
[threat-actors] pr.review: Add SectorJ04 as alias of TA505
2023-01-27 13:32:58 +01:00
o1mate
0b661d4f80
Added two new galaxies : An ammunition galaxy containing a list of known sold ammunitions ordered by brands, and a firearm galaxy containing two clusters (handguns, shotguns) scrapped from a famous vendor and ordered by model name (Format : Model name - SKU).
2023-01-26 08:34:38 -05:00
Delta-Sierra
89bb349184
Merge https://github.com/MISP/misp-galaxy
2023-01-26 11:46:14 +01:00
Delta-Sierra
0bb1f48ad6
fix missing brackets
2023-01-25 14:47:22 +01:00
e87d39e3f4
fix: [region] JQed all the things !!
2023-01-25 09:24:52 +01:00
Delta-Sierra
50ca40e408
add Anubis & Godfather android banking trojans
2023-01-25 09:05:19 +01:00
51610df907
chg: [region] Updated the region
Galaxy Cluster
...
- Added missing entry (Antarctica)
- Ordered the `subregions` meta field
2023-01-24 22:53:54 +01:00
ofenomeno
cb8d700e62
adding uavs
2023-01-24 19:55:46 +01:00
2f0dfc7656
chg: [sigma] updated
2023-01-23 10:10:46 +01:00
4a342354f9
chg: [sigma] updated
2023-01-20 13:58:11 +01:00
5c21588d7c
add: [country] Manually added the missing relations to some country
cluster values
...
- The previous commit (071ecb8
) that added the
mahority of relations between countries and
regions were automatically added based on the
country names specified in the `region` cluster.
The relations added here are the remaining
countries that are not litterally defined the
same way they are in the `region` cluster
2023-01-16 22:22:42 +01:00
325f51479b
chg: [country] Clarified the US cluster value
2023-01-16 22:20:30 +01:00
071ecb8a52
add: [country] Added references between country
cluster values and the related region they're located in, from the region
galaxy cluster
2023-01-16 21:35:22 +01:00
323f9f47a1
chg: [sigma] version must be an integer
2023-01-12 16:45:21 +01:00
fd226d47a2
chg: [sigma] new version of the cluster
2023-01-12 14:10:22 +01:00
c0fdfb0e99
chg: [sigma] updated with latest version + new relationship script
2023-01-12 13:46:31 +01:00
e54366fb87
chg: [threat-actor] added the missing synonyms
2023-01-10 15:55:30 +01:00
187701bacb
chg: [sigma] regenerated from the test script (also updated the script
...
to ensure UUID consistency for the galaxy)
2023-01-06 15:36:33 +01:00
9955401791
chg: [sigma] jq all the things
2023-01-06 15:13:35 +01:00
8539361df5
Merge branch 'main' of https://github.com/jstnk9/misp-galaxy into jstnk9-main
2023-01-06 15:11:27 +01:00
jstnk9
5bcec1d72f
Merge branch 'MISP:main' into main
2023-01-03 11:10:49 +01:00
Jürgen Löhel
d4debd619b
chg: [ransomware] Extends the entry for JCrypt
...
* Add the reference to MafiaWare666 based on the latest research from
the Avast Threat Lab: https://decoded.avast.io/threatresearch/decrypted-mafiaware666-ransomware/
* Add more infos from Andrew Ivanovs the great blog post: https://id-ransomware.blogspot.com/2020/12/jcrypt-ransomware.html
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2022-12-23 01:44:20 -06:00
Delta-Sierra
3f4edb480b
add Malteiro
2022-12-16 16:43:50 +01:00
jstnk9
cb19f6bda7
galaxy for sigma rules
2022-12-09 08:48:54 +01:00
Delta-Sierra
5931f51d7a
add TAG-53
2022-12-08 11:31:02 +01:00
Delta-Sierra
3ea2d62a83
Version Update
2022-11-28 16:27:54 +01:00
Delta-Sierra
6016b1000c
Merge https://github.com/MISP/misp-galaxy
2022-11-28 16:17:08 +01:00
Delta-Sierra
5d83563e0e
Fix Duplicate
2022-11-28 16:15:40 +01:00
Delta-Sierra
6c36295318
Update several RAT & Ransomwares
2022-11-28 16:13:38 +01:00
de12f46ba6
chg: [mitre] updated
2022-11-28 12:48:29 +01:00
fda4160bed
chg: [target-information] fix the duplicate
2022-11-24 15:08:16 +01:00
f15e4ed3bc
chg: [target-information] duplicate removal
2022-11-24 15:05:47 +01:00
1d9a73abdd
chg: [target] fix duplicate synonyms
2022-11-24 15:03:18 +01:00
e3126ef857
fix: [clusters] Fixed some other few meta
field names
2022-11-24 09:17:28 +01:00
823124d422
fix; [mitre-ics-assets] Fixed some refs
meta field names
2022-11-23 20:44:46 +01:00
493a5bf94e
fix: [target-information] Fixed synonyms
meta field name
2022-11-23 20:40:35 +01:00
5c979ae554
fix: [tool] Houdini relationship to something which exist (ok I know it's Houdini)
2022-11-22 15:19:40 +01:00
0b6034d9be
Merge pull request #800 from Delta-Sierra/main
...
Add ransomwares
2022-11-22 15:11:42 +01:00
8947d0035b
fix: [sigma rules] until new the PR and tool is done for sigma. The
...
galaxy is removed.
2022-11-22 15:08:17 +01:00
Delta-Sierra
5f0d7f6d68
add VJw0rm description
2022-11-22 14:55:10 +01:00
Delta-Sierra
f4abf37b01
fix versions
2022-11-22 12:45:15 +01:00
Delta-Sierra
c02b74f999
merge
2022-11-22 12:43:18 +01:00
Delta-Sierra
ffc68b9b8f
add several ransomwares
2022-11-22 12:40:47 +01:00
Delta-Sierra
e316382b8a
add qakbot ref
2022-11-22 12:06:03 +01:00
Delta-Sierra
8bf6d73d66
add BazarCall campaign
2022-11-22 09:08:28 +01:00
Delta-Sierra
3c7230e38e
add Bazarbackdoor Synonyms
2022-11-22 09:00:04 +01:00
Thomas Dupuy
be7450494e
Add Evasive Panda Threat Actor
2022-11-18 16:38:11 +00:00
4844a7021c
chg: [sigma] duplicate value changed
2022-11-18 14:36:02 +01:00
c41b99d8b9
fix: [sigma] remove duplicate references
2022-11-18 14:21:27 +01:00
59f5fc5f76
Merge branch 'main' of github.com:MISP/misp-galaxy into main
2022-11-18 14:18:29 +01:00
7d4011a0a2
chg: [sigma] jq all the things
2022-11-18 14:17:52 +01:00
Terrtia
e3b6e9d229
fix: [handicap] fix galaxy icon + name + type
2022-11-17 15:16:05 +01:00
9b8619bbbe
Merge branch 'main' of https://github.com/jstnk9/misp-galaxy into jstnk9-main
2022-11-16 11:07:50 +01:00
Jürgen Löhel
f595195cd2
chg: [botnets] Adds KmsdBot
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2022-11-15 18:10:39 -06:00
Jstnk9
473f1a13aa
galaxy related to sigma rtules
...
galaxy related to sigma rtules
2022-11-15 22:56:18 +01:00
Delta-Sierra
2269f4decd
fix tool type
2022-11-15 13:56:53 +01:00
Delta-Sierra
9fc65c0e34
version fix
2022-11-15 13:37:02 +01:00
Delta-Sierra
91d535925f
version fix
2022-11-15 13:36:49 +01:00
Delta-Sierra
3837058ab1
merge
2022-11-15 12:54:03 +01:00
Delta-Sierra
d020efd276
add raspberry Robin worm & others
2022-11-15 11:57:10 +01:00
b787bbeb23
Merge pull request #792 from nyx0/main
...
Add RomCom TA.
2022-11-05 07:50:20 +01:00
3b196f8361
Merge pull request #791 from Mathieu4141/threat-actors/add-phosphorus-alias-to-apt-35
...
[threat-actors] Add Phosphorus in APT35 aliases
2022-11-05 07:49:55 +01:00
Thomas Dupuy
9ac53e5d5e
Add RomCom TA.
2022-11-04 02:34:10 +00:00
6c4da5dd55
Merge pull request #790 from Mathieu4141/threat-actors/fix-dust-storm
...
[threat-actors] Remove DustStorm alias from APT10
2022-11-03 11:35:20 +01:00
52a6fff6a2
Merge pull request #788 from Mathieu4141/threat-actors/fix-cobalt-dickens
...
[threat-actors] Remove cobalt dickens duplicate
2022-11-03 11:27:08 +01:00
3b4dcd6ad3
Merge pull request #787 from Mathieu4141/threat-actors/fix-subaat-duplicate
...
[threat-actors] Remove subaat duplicate
2022-11-03 11:26:21 +01:00
Mathieu Beligon
8a9dd47f8f
[threat-actors] Add Phosphorus in APT35 aliases
2022-11-02 23:49:22 -07:00
Mathieu Beligon
21d4292faf
[threat-actors] Remove DustStorm alias from APT10
2022-11-02 23:31:31 -07:00
Mathieu Beligon
e61733591f
[threat-actors] Remove SectorJ04 duplicate
2022-11-02 20:30:40 -07:00
Mathieu Beligon
9f0869097a
[threat-actors] Remove cobalt dickens duplicate
2022-11-02 18:09:42 -07:00
Mathieu Beligon
e3e5560e37
[threat-actors] Remove subaat duplicate
2022-11-02 17:57:47 -07:00
Mathieu Beligon
5801bbcfc1
[threat-actors] Remove Skeleton Spider duplicate
2022-11-02 17:38:07 -07:00
015650c6d7
chg: [mitre-attack] updated to version 12.0
2022-11-01 22:39:33 +01:00
Delta-Sierra
9952366667
add Prynt Stealer & variants
2022-10-14 16:03:45 +02:00
Delta-Sierra
355025eb5b
fix metadata in wrong slot
2022-10-04 13:28:42 +02:00
Delta-Sierra
e5b3062912
add Volatile Cedar synonym
2022-10-03 16:06:13 +02:00
Thomas Dupuy
4bcf80f01b
Add SharPyShell tool.
2022-10-02 22:00:54 +00:00
409c82f40c
Merge pull request #781 from Mathieu4141/threat-actors/fix-neodymium
...
[threat-actors] Fix G0055 (NEODYMIUM) alias
2022-09-30 06:39:31 +02:00
588184bacd
Merge pull request #780 from Mathieu4141/threat-actors/fix-svmondr
...
[threat-actors] Remove SVCMONDR duplicate
2022-09-30 06:38:56 +02:00
800006e6ab
Merge pull request #778 from Mathieu4141/threat-actors/fix-malware-reuser-duplicate
...
[threat-actors] Fix Volatile Cedar and Dancing Salome conflicts
2022-09-30 06:37:15 +02:00
Mathieu Beligon
74c6835d18
[threat-actors] Fix G0055 (NEODYMIUM) alias
2022-09-29 17:16:57 -07:00
Mathieu Beligon
a740e35687
[threat-actors] Remove SVCMONDR duplicate
2022-09-29 16:11:19 -07:00
Mathieu Beligon
5994fa4160
[threat-actors] Fix Volatile Cedar and Dancing Salome conflicts
2022-09-29 14:51:38 -07:00
Mathieu Beligon
4f47e6e2d3
[threat-actors] Equation group: separate from Lamberts and add tools
2022-09-29 11:28:54 -07:00
Thomas Dupuy
c66d6823a1
Add APT-Q-12 Threat Actor.
2022-09-29 02:30:41 +00:00
c3b65a2d15
chg: [threat-actor] JSON fix
2022-09-27 08:18:13 +02:00
067e449a41
Merge branch 'main' of https://github.com/nyx0/misp-galaxy into nyx0-main
2022-09-27 08:17:41 +02:00
Christophe Vandeplas
e259458d5a
chg: [mitre] bump to v11.3
2022-09-27 07:30:13 +02:00
Thomas Dupuy
bfd1812cef
Add Void Balaur.
2022-09-27 00:11:20 +00:00
eacab6ca27
new: [malpedia] remove duplicate UUIDs objects (coming from Malpedia API)
2022-09-26 10:58:09 +02:00
7cd322640f
Merge pull request #771 from Delta-Sierra/main
...
fetch malpedia
2022-09-26 10:07:24 +02:00
Delta-Sierra
a611230bef
fetch malpedia
2022-09-26 09:23:07 +02:00
Mathieu Beligon
22a39f4fdc
[threat-actors] Add BITWISE SPIDER
2022-09-20 11:23:33 -07:00
9b8b51fe53
Merge pull request #769 from Mathieu4141/threat-actors-add/no-name-057-06
...
[threat-actors] Add NoName057(16)
2022-09-17 07:43:42 +02:00
2f169e4258
Merge pull request #766 from Mathieu4141/threat-actors/fix-ta505
...
[threat-actors] Clean TA505 aliases
2022-09-17 07:43:18 +02:00
Mathieu Beligon
580d2c6931
[threat-actors] Add NoName057(16)
2022-09-16 20:11:06 -06:00
30cb4e7e60
Merge pull request #768 from Delta-Sierra/main
...
New clusters
2022-09-16 06:40:43 +02:00
Delta-Sierra
8202a7f48f
Add PlugX ref
2022-09-15 15:39:47 +02:00
Delta-Sierra
0903300b75
Add Chisel
2022-09-15 13:24:49 +02:00
Delta-Sierra
021fcd2c91
add Lorenz ransomware
2022-09-15 10:29:46 +02:00
1c8d82cfcc
new: [threat-actor] hezb added
2022-09-14 11:00:33 +02:00
Christophe Vandeplas
b011ddee5b
fix: [360net] fixes null entries in lists
2022-09-13 22:12:51 +02:00
Christophe Vandeplas
c5a5fa7cfa
chg: [360net] add 360.net APT list fixes #764
2022-09-13 21:48:16 +02:00
Mathieu Beligon
e1f5d3b5d8
[threat-actors] Keep meta from old Xenotime
2022-09-13 11:40:17 -07:00
Mathieu Beligon
4ff0bdfe8e
[threat-actors] Clean TA505 aliases
2022-09-13 11:34:02 -07:00
Delta-Sierra
e3d88f45c6
add Dark.IoT
2022-09-13 13:35:55 +02:00
Delta-Sierra
6dba3abe13
add hezb
2022-09-13 10:40:00 +02:00
Mathieu Beligon
273c7c9b97
[threat-actors] Remove Xenotime duplicate
2022-09-12 17:10:49 -07:00
Delta-Sierra
705d0d2e72
add BumbleBee backdoor
2022-09-12 10:51:43 +02:00
Delta-Sierra
0440db12e9
add DangerousSavanna campaign
2022-09-07 11:01:23 +02:00
Delta-Sierra
77db2370b1
Add Lockbit synonym
2022-09-07 11:00:41 +02:00
Delta-Sierra
775d3c183b
Add Lockbit synonym
2022-09-07 09:26:38 +02:00
Rony
aea413cebf
chg: [threat-actor] version bump
2022-09-01 10:32:01 +00:00
Rony
db913e5ab4
fix: [threat-actor] remove duplicate entries
2022-09-01 09:53:11 +00:00
Rony
6aea5ee05c
chg: [threat-actor] add Aoqin Dragon
2022-09-01 09:46:43 +00:00
Rony
fb0cf3c7e5
chg: [threat-actor] miscellaneous updates
2022-09-01 09:17:31 +00:00
Daniel Plohmann
d18f5bc8b6
mini-fix: adding https protocol to a reference
...
in automated processing and display, this may otherwise lead to a malformed local / relative link.
2022-08-30 17:08:03 +02:00
5175fb0364
Merge pull request #760 from Delta-Sierra/main
...
Add GootLoader & MOUSEISLAND in tool
2022-08-29 12:02:55 +02:00
Rony
e7178a1e08
fix: [threat-actor] remove duplicate entries from APT9
2022-08-27 12:54:32 +00:00
Rony
27300c6381
chg: [threat-actor] add avast blog to APT40
2022-08-27 12:41:31 +00:00
Rony
7f526e230b
chg: [threat-actor] add Microsoft and PwC report to actors' references
2022-08-27 12:34:36 +00:00
Rony
6ad9699a38
chg: [threat-actor] add recorded future reference to RedAlpha
2022-08-27 12:10:51 +00:00
Rony
2dc138ae01
chg: [threat-actor] add Adam Kozy's testimony ro APT41 and APT26
2022-08-27 12:08:11 +00:00
Rony
0b140b7097
chg: [threat-actor] miscellaneous updates including merge of some actors and fix the error committed in 9cfcc0d9ac
2022-08-27 11:58:03 +00:00
8bea9f3b4b
Merge pull request #755 from Mathieu4141/threat-actors/fix-winnti
...
[threat-actors] Fix Axiom/Winnti/Suckfly/APT41 conflicts
2022-08-27 08:25:20 +02:00
Mathieu Béligon
9cfcc0d9ac
Add aliases to APT41
...
Co-authored-by: Rony <rony_123@protonmail.ch>
2022-08-26 14:54:02 -07:00
Mathieu Beligon
6e00329ba6
[threat-actors] Fix aliases
2022-08-26 11:09:29 -07:00
Delta-Sierra
534dacb7fb
add GootLoader
2022-08-26 10:12:36 +02:00
Delta-Sierra
d5a9365aae
add MOUSEISLAND
2022-08-26 09:23:38 +02:00
Mathieu Beligon
9b714dcd76
[threat-actors] Merge Axiom into APT17
2022-08-25 13:49:07 -07:00
Delta-Sierra
5b3c395f10
jq
2022-08-24 14:27:33 +02:00
Delta-Sierra
cb422c2190
update Guildma
2022-08-24 14:07:01 +02:00
Yosirion95
cda80e5496
Add synonyms to sector.json
2022-08-21 11:09:50 +02:00
9efca4c41b
fix: [threat-actor] UUID reused fixed (UUIDs cannot be reused across different cluster)
...
Add the missing the relationship for the new UUID
2022-08-21 09:17:56 +02:00
Rony
5b42a09dc2
add PARINACOTA to threat-actor.json
...
MSTIC names digital crime actors based on global volcanoes
2022-08-20 17:10:15 +00:00
Rony
6fd584fa88
remove APT36/ Transpert Tribe from microsoft-activity-group.json cause we don't know any MSTIC name yet.
2022-08-20 17:06:18 +00:00
6b137ea12c
Merge pull request #749 from Mathieu4141/threat-actors/fix-naikon-cluster
...
[threat actors] Fix threat actors related to Lotus Panda
2022-08-20 11:46:15 +02:00
Mathieu Beligon
7f82616c10
fix axiom related field
2022-08-19 12:48:40 -07:00
Mathieu Beligon
969f461709
merge into apt41
2022-08-19 12:45:47 -07:00
Christophe Vandeplas
1b69b654a8
chg: [atrm] bump to latest ATRM version
2022-08-19 21:19:23 +02:00
Mathieu Beligon
fd9201e9e0
Merge APT22 and suckfly
2022-08-19 12:16:30 -07:00
Mathieu Beligon
768c94671c
Fix hellsing ref
2022-08-19 11:34:16 -07:00
a8b234d694
Merge pull request #753 from Mathieu4141/threat-actors/fix-bronze-president
...
[threat-actors] Remove duplicated BRONZE PRESIDENT entity
2022-08-19 06:26:11 +02:00
Mathieu Béligon
fcd6faec78
Capitalize override panda alias
...
Co-authored-by: Rony <rony_123@protonmail.ch>
2022-08-18 20:51:03 -07:00
Mathieu Béligon
54f3ef2831
capitalize lotus panda alias
...
Co-authored-by: Rony <rony_123@protonmail.ch>
2022-08-18 20:50:32 -07:00
Mathieu Béligon
c9b11553eb
normalize APT30 alias
...
Co-authored-by: Rony <rony_123@protonmail.ch>
2022-08-18 20:32:44 -07:00
Mathieu Beligon
c1abedb446
Move Lotus Panda alias to Lotus Blossom
2022-08-18 20:21:31 -07:00
Mathieu Beligon
a61ef2a88f
[threat-actors] Fix Axiom/Winnti/Suckfly/APT41 conflicts
2022-08-18 17:03:26 -07:00
Mathieu Beligon
84e69ad4be
Add DarkCommet as a tool of GoldenRAT
2022-08-18 15:47:04 -07:00
Mathieu Beligon
1acc51a7a6
[threat-actors] Add more data about APT-C-27
2022-08-18 15:44:18 -07:00
Mathieu Beligon
ec988c97d0
[threat-actors] Remove duplicated APT-C-27
2022-08-18 15:34:08 -07:00
Mathieu Beligon
d9046c8619
[threat-actors] Remove duplicated BRONZE PRESIDENT entity
2022-08-18 15:12:18 -07:00
Mathieu Beligon
a046e8094d
Merge APT30 and Naikon
2022-08-18 11:36:45 -07:00
Mathieu Beligon
5e4a4c3453
Merge branch 'main' into threat-actors/fix-naikon-cluster
2022-08-18 09:01:36 -07:00
Mathieu Beligon
264e764dfa
Remove ATK34 alias
2022-08-18 08:59:04 -07:00
Delta-Sierra
3f036db1e3
add TA558
2022-08-18 15:54:28 +02:00
Mathieu Beligon
71e3e1f3eb
Fix ATK aliases
2022-08-17 13:39:43 -07:00
Mathieu Beligon
a6242d4732
Merge branch 'main' into threat-actors/fix-naikon-cluster
2022-08-17 13:37:01 -07:00
Mathieu Beligon
0d6399aa2b
Add ATK78 alias for Thrip
2022-08-17 12:04:32 -07:00
Mathieu Beligon
53282255ce
Branch out Goblin Panda from Hellsing
2022-08-17 11:55:35 -07:00
Mathieu Beligon
3f50cf0175
Create a tool for Esile
2022-08-17 11:19:30 -07:00
Rony
f608312577
addresses https://github.com/MISP/misp-galaxy/pull/751#issuecomment-1217680586
2022-08-17 08:52:35 +00:00
Rony
ccd10b54f4
remove duplicate reference
2022-08-17 12:49:56 +05:30
Rony
0cec882cc5
merge microcin/sixlittlemonkeys to vicious panda
2022-08-17 07:06:51 +00:00
a373909bb1
Merge pull request #748 from r0ny123/patch-2
...
Update threat-actor.json
2022-08-17 07:44:46 +02:00
352998a84d
fix: [threat-actor] add missing refs for APT33 including CFR link
2022-08-17 07:40:23 +02:00
Mathieu Beligon
d05b29c1af
[threat-actors] Remove duplicate APT33
2022-08-16 17:15:30 -07:00
Mathieu Beligon
9c6f106928
[threat actor] Fix aliases related to Lotus Panda
2022-08-16 16:58:35 -07:00
Rony
5b25b574b3
add uac-0010 references from cert-ua
2022-08-16 10:19:53 +00:00
Rony
370045b01d
Merge "red october" and "cloud atlas" to inception framework"
2022-08-16 09:30:29 +00:00
Rony
62b168600f
fix duplicates
2022-08-16 12:15:30 +05:30
Rony
490bc6a05c
fix duplicate
2022-08-16 12:10:27 +05:30
Rony
bbe84c5985
updates to russian actors
2022-08-16 12:07:59 +05:30
Rony
de76aef023
Update threat-actor.json
2022-08-16 10:49:13 +05:30
Rony
f4b63d4514
updates to tianwu
2022-08-16 10:30:33 +05:30
96d31aa8c7
chg: [threat-actor] jq all the things
2022-08-11 17:50:00 +02:00
Thomas Dupuy
ed24dcaf19
Add link for SLIME29.
2022-08-11 15:41:01 +00:00
Thomas Dupuy
912050b9b7
Update commit based on feeback.
2022-08-11 15:20:32 +00:00
Thomas Dupuy
6e0df72ef4
Add Threat Actors from BH Asia22 prez.
2022-08-10 18:53:38 +00:00
Christophe Vandeplas
1369756810
chg: [atrm] Add Azure Threat Research Matrix Galaxy and generation script
2022-08-06 21:19:31 +02:00
Daniel Plohmann
bdaadea58e
removing a leading double quote in a URL.
2022-08-02 18:17:58 +02:00
Daniel Plohmann
bc20a463c8
merging TG2003 / Elephant Beetle into FIN13
...
as indicated in the respective resources published by the organizations using these aliases.
2022-08-02 14:11:43 +02:00
6427746ad8
Merge pull request #727 from Mathieu4141/threat-actors/merge-cutting-kitten-cleaver
...
Fix Cleaver aliases
2022-07-27 23:17:42 +02:00
63f5122ad4
Merge pull request #742 from r0ny123/patch-1
...
Update threat-actor.json
2022-07-27 18:56:47 +02:00
Mathieu Beligon
51aacd6b03
Reduce diff with old version
2022-07-26 23:53:22 -07:00
Mathieu Beligon
acc6ada575
r0ny123.review: Use Cutting Kitten as main value for ITSecTeam
2022-07-26 23:27:39 -07:00
Mathieu Beligon
d815bfa174
Merge remote-tracking branch 'upstream/main' into threat-actors/merge-cutting-kitten-cleaver
2022-07-26 23:22:03 -07:00
Daniel Plohmann
26f6a33695
more aliases from Unit 42
2022-07-26 11:09:33 +02:00
Rony
5a7f3a7207
fix
2022-07-25 17:17:52 +05:30
Rony
8ce0df6eb4
Update threat-actor.json
...
Merge aquatic panda & earth lusca
2022-07-25 17:15:23 +05:30
6b6398bf2d
fix: [threat-actor] incorrect merge fixed
2022-07-20 18:45:50 +02:00
b4ce9a9453
Merge branch 'main' of https://github.com/r0ny123/misp-galaxy into r0ny123-main
2022-07-20 18:41:27 +02:00
Rony
add6b27466
update
2022-07-20 21:39:33 +05:30
Rony
2b54df56f9
update
2022-07-20 21:32:11 +05:30
Rony
2e045d9c8c
chg: [fix] resolve conflict
2022-07-20 21:28:15 +05:30
Daniel Plohmann
5825783a85
removed duplicate UUID for Kinsing
...
my apologies, looks like I had not rolled a new UUID for one of the entries added...
2022-07-20 17:07:05 +02:00
Rony
932fcf1871
added Red Nue
2022-07-20 15:07:35 +05:30
Rony
082039b3b0
added CN actors from secureworks threat profile
...
https://www.secureworks.com/research/threat-profiles?filter=item-china and fixed some AKAs
2022-07-20 14:52:58 +05:30
Daniel Plohmann
ed32c508b7
added more Unit 42 aliases / groups
2022-07-20 08:38:03 +02:00
Rony
000bfe92d9
add APT9/Red Pegasus & BRONZE EDGEWOOD/Red Hariasa
2022-07-20 10:04:58 +05:30
Rony
2e8a577b0c
add PwC naming to CN actors
2022-07-20 09:45:21 +05:30
Rony
3fabd58416
chg: [threat-actor] fixed
2022-07-19 23:36:30 +05:30
Rony
79c84d3768
add Earth Berberoka, Earth Lusca and Earth Wendigo
2022-07-19 22:42:50 +05:30
Daniel Plohmann
082d506b64
adding new Unit 42 names
...
First PR: those are the directly mappable names. I will follow up after deconfliction and then with a few new entries.
2022-07-19 08:45:09 +02:00
Daniel Plohmann
240a757826
Update threat-actor.json
...
adding Predatory Sparrow due to recent events.
2022-07-13 10:02:07 +02:00
cf603e8160
Merge pull request #736 from Delta-Sierra/main
...
add Qbot
2022-07-12 18:41:33 +02:00
Thomas Dupuy
90da0d798f
Set country to LB instead of IR based on operational activity.
2022-07-12 16:21:41 +00:00
Delta-Sierra
b1c853bf42
update version
2022-07-12 15:51:55 +02:00
Thomas Dupuy
1a8835bcae
Remove list from POLONIUM TA.
2022-07-12 13:11:11 +00:00
Thomas Dupuy
a86d866534
Add POLONIUM TA.
2022-07-12 12:14:27 +00:00
Delta-Sierra
d40017ae50
add Qbot
2022-07-12 14:03:43 +02:00
Delta-Sierra
6c6355f2ba
fix typo
2022-07-12 11:31:08 +02:00
Delta-Sierra
300d608770
jq
2022-07-12 10:54:37 +02:00
Delta-Sierra
71c93f5b24
fix caps typo
2022-07-12 10:53:14 +02:00
Delta-Sierra
4ea34fc5a4
Merge https://github.com/Delta-Sierra/misp-galaxy into main
2022-07-12 10:51:59 +02:00
Delta-Sierra
924eda26ca
Add EnemyBot +relationships
2022-07-12 10:49:11 +02:00
Deborah Servili
ca7d524d9c
Merge branch 'main' into main
2022-07-08 16:27:28 +02:00
Delta-Sierra
29aa7b3f69
add Maui ransomware
2022-07-08 14:49:12 +02:00
Delta-Sierra
56a53433f0
add HelloXD ransomware
2022-07-08 12:05:31 +02:00
Delta-Sierra
279b89f6d9
fix duplicate extension-2
2022-07-06 09:38:02 +02:00
Delta-Sierra
67d5f5c7c0
fix duplicate extension
2022-07-06 09:34:11 +02:00
Delta-Sierra
7e37fa0cdd
merge + update medusalocker
2022-07-06 09:28:46 +02:00
Delta-Sierra
c2e7ef4fab
Update Medusa Locker and others
2022-07-06 08:43:59 +02:00
marjatech
587dc8560b
add script to automate malpedia update
2022-07-04 14:24:34 +02:00
Mathieu Beligon
693eed8d78
[threat actor] Break Cleaver aliases into respective entries
2022-07-04 14:05:29 +02:00
marjatech
1212a75cc4
update malpedia
2022-07-04 11:02:02 +02:00
Mathieu Beligon
d63c990dad
[threat-actors] Separate ITSecTeam from Cleaver
2022-06-30 14:34:05 +02:00
Mathieu Beligon
b8d4ffdbde
Merge Cutting Kitten and Cleaver
2022-06-29 20:15:12 +02:00
Koen Van Impe
0c9aa68db6
Update surveillance-vendor.json
2022-06-22 13:30:55 +02:00
Koen Van Impe
22c2f7b999
Add RCS Lab S.p.A. to surveillance-vendor
2022-06-22 11:20:52 +02:00
Mathieu Beligon
d79c5bd1ab
Add ToddyCat Threat actor
2022-06-21 15:12:42 +02:00
Rony
c030fcdab6
chg: [threat-actor] added PwC naming for Indian actors
...
https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
2022-06-11 15:46:54 +05:30
Thanat0s
44a99d066a
Y en a un peut plus je vous le mets quand meme ?
2022-06-11 04:24:04 -04:00
Thanat0s
57befd7259
jq all the things
2022-06-10 19:12:12 -04:00
Thanat0s
51f98f4706
Attck link + typo on TA551
2022-06-10 18:40:16 -04:00
Thanat0s
f97fee7135
Typo on TA551
2022-06-10 18:38:25 -04:00
Thanat0s
297acc0f5e
Add Mitre vs Thales RosettaStone
2022-06-10 18:24:15 -04:00
Rony
e916267c7c
chg: [threat-actor] add reference to bitter & sidewinder group
2022-06-08 23:22:17 +05:30
Christophe Vandeplas
39073004c4
[mitre] bump to MITRE ATT&CK v11.2
2022-05-25 21:03:14 +02:00
Christophe Vandeplas
4a469299fd
[mitre] update sorting algo
...
will make future ATT&CK updates less noisy in the git diff
2022-05-25 21:00:57 +02:00
Mathieu Beligon
dca70783bf
[threat-actors] validate file
2022-05-23 11:32:24 +02:00
Mathieu Beligon
c1cfc19871
[threat actors] Remove dead link for sandworm threat actor
2022-05-23 11:30:04 +02:00
Mathieu Beligon
36a1466661
[threat-actors] Add RansomHouse
2022-05-23 11:29:39 +02:00
a838eaf9db
Merge pull request #717 from jloehel/krane
...
chg: [cryptominers] Adds Krane
2022-05-18 08:17:16 +02:00
Jürgen Löhel
1be9a10ef9
chg: [cryptominers] Adds Krane
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2022-05-17 14:47:29 -05:00
Jürgen Löhel
9db5d18114
chg: [android] Adds Vulture
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2022-05-17 14:16:21 -05:00
Rony
2721522e82
chg: [threat-actor] add exotic lily, ta578, ta579
2022-05-14 20:52:15 +05:30
Jürgen Löhel
45da13ce5e
chg: [backdoors] Adds BPFDoor
...
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
2022-05-11 19:06:19 -05:00
fcdc6c86e6
chg: [threat-actor] add TG2003 synomym to Elephant Beetle
2022-05-09 14:24:28 +02:00
9130365e2e
chg: [threat-actor] Elephant Beetle added
...
Fix #708
2022-05-09 14:23:12 +02:00
bb434b11cf
chg: [threat-actor] ModifiedElephant added
...
Fix #709
2022-05-09 14:16:01 +02:00
06550a7945
chg: [threat-actor] fix refs field -> it's always an array
2022-05-09 13:46:16 +02:00
b67e3ed3f8
Merge branch 'threatactor-cosmiclynx-add' of https://github.com/adammchugh/MISP-Galaxy-Updates into adammchugh-threatactor-cosmiclynx-add
2022-05-09 13:43:44 +02:00
Rony
c0be6677c2
chg: [threat-actor] added actor Red Menshen
...
https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
2022-05-07 15:44:10 +05:30
Rony
11eca69ebc
chg: [threat-actor] added Curious Gorge
2022-05-07 12:40:35 +05:30
Daniel Plohmann
26c1850377
Update threat-actor.json
...
adding Red Dev 4 as alias for GALLIUM as used by PwC.
2022-05-06 09:47:48 +02:00
Daniel Plohmann
06c293072c
Update threat-actor.json
...
adding UNC3524 to the actor galaxy cluster.
2022-05-04 13:21:56 +02:00
3c7
0ad65fbe9f
Forgot to jq all the things
2022-04-28 09:42:25 +02:00
3c7
dfb6c0668e
Added SaintBear
2022-04-28 09:36:25 +02:00
Christophe Vandeplas
33476bec81
chg: [mitre] bump to MITRE ATT&CK v11.0
2022-04-25 18:29:57 +02:00
664f6d80cc
chg: [threat-actor] Killnet description added
2022-04-21 15:05:50 +02:00
1e383e2452
chg: [threat-actor] version updated
2022-04-21 14:53:14 +02:00
Mathieu Beligon
c8455a6c4d
[actors] Add killnet
2022-04-21 14:06:28 +02:00
Adam McHugh
53a0fc56d3
Added Cosmic Lynx Threat Actor from Agari Whitepaper advisory
2022-04-18 10:16:26 +09:30
bca7381f33
fix: [ransomware] refs are within meta
2022-04-17 15:43:23 +02:00
eb7c5ebaf1
fix: [ransom] remove empty ref
2022-04-17 15:39:02 +02:00
bc696b43f4
chg: [ransomware] jq all the things
2022-04-17 15:35:50 +02:00
00d33fd292
Merge pull request #701 from adammchugh/ransomware-conti-update
...
Ammended Conti ransomware entry with ACSC 2021-010 advisory data
2022-04-17 15:35:25 +02:00
66744a4cd0
Merge pull request #704 from adammchugh/cryptominers-bluemockingbird-add
...
Added Cryptominer Blue Mockingbird from RedCanary advisory.
2022-04-17 14:43:59 +02:00
14907e3eef
Merge pull request #703 from adammchugh/threatactor-copypaste-add
...
Added Copy-Paste Threat Actor from ACSC Advisory 2020-008
2022-04-17 14:43:37 +02:00
Adam McHugh
84eac4b102
Added Cosmic Lynx Threat Actor from Agari Whitepaper advisory
2022-04-17 19:50:08 +09:30
Adam McHugh
f00e80ae7e
Added Cryptominer Blue Mockingbird from RedCanary advisory.
2022-04-17 19:44:42 +09:30
Adam McHugh
cff8a38c5f
Added Copy-Paste Threat Actor from ACSC Advisory 2020-008
2022-04-17 19:37:26 +09:30
Adam McHugh
622c0502aa
Ammended Conti ransomware entry with ACSC 2021-010 advisory data
2022-04-17 19:23:11 +09:30
Adam McHugh
99caab201f
Ammended Blackcat ransomware entry with ACSC 2022-004 advisory data
2022-04-17 18:05:24 +09:30
Thomas Dupuy
bd05eb0bba
upd: [cluster] add Threat Actor BladeHawk.
2022-04-11 17:03:19 +00:00
Thomas Dupuy
209391f110
upd: [cluster] add ref and synonyms for Energetic Bear.
2022-04-07 18:26:58 +00:00
b649057a5a
chg: [handicap] fixed more fields
2022-04-04 11:09:30 +02:00
aff4345074
chg: [handicap] more cleanup
2022-04-04 11:01:38 +02:00
269f91ad75
chg: [handicap] more clean-up of uuid values
2022-04-04 10:56:29 +02:00
d3d4e7186b
chg: [handicap] fix name of the clusters
2022-04-04 10:43:56 +02:00
7e6390c336
Merge pull request #694 from AgatheMgt/main
...
Handicap
2022-04-04 10:41:06 +02:00
Rony
a08ddaf548
Add Avivore & HAZY TIGER/Bitter
2022-04-02 01:14:18 +05:30
Rony
50f39edc10
Revert "update threat actors meta"
2022-04-02 00:55:38 +05:30
Delta-Sierra
73f71c8b15
dup
2022-04-01 16:51:27 +02:00