Commit graph

831 commits

Author SHA1 Message Date
Deborah Servili
35582f7ed5
new threat actors & tools 2018-10-01 11:52:40 +02:00
2402c7d98f
chg: [tool] NOKKI added
ref: https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/
2018-09-29 09:01:47 +02:00
Deborah Servili
3649e03ad5 Merge branch 'master' of https://github.com/MISP/misp-galaxy 2018-09-28 16:28:16 +02:00
Deborah Servili
f828c8f79e
add synonym 2018-09-28 16:18:54 +02:00
Deborah Servili
a27534cfa1
add refs 2018-09-28 15:40:00 +02:00
49fe210812
Merge pull request #270 from Delta-Sierra/master
new clusters, relations and information
2018-09-28 12:57:13 +02:00
Deborah Servili
97581d7185
jq 2018-09-28 11:20:38 +02:00
Deborah Servili
fbf21487cf
new clusters and informtion 2018-09-28 11:08:21 +02:00
46eddf1874
chg: [botnet] Torii added 2018-09-27 15:43:49 +02:00
Deborah Servili
78c1f07359
new ransomware and relations 2018-09-27 15:42:20 +02:00
Nex
014aa325b7 Added missing country values 2018-09-26 23:05:46 +02:00
Deborah Servili
29beb01dc3
add relationships on Mirai 2018-09-24 16:06:36 +02:00
Deborah Servili
f7e10cb38d
add references 2018-09-24 14:58:21 +02:00
Deborah Servili
77897be97e
add BusyGasper android spyware 2018-09-24 12:12:41 +02:00
Deborah Servili
2bc8e1e719
add Cobalt Dickensthreat actor 2018-09-24 11:51:09 +02:00
Deborah Servili
69c5fc30e5
add remcos ref 2018-09-24 11:07:17 +02:00
Deborah Servili
5a1734f170
update version 2018-09-21 11:16:36 +02:00
Deborah Servili
3c7e367cbf
fix field mistake 2018-09-21 11:14:19 +02:00
Deborah Servili
1cee9d71e0
update Lazarus group cluster 2018-09-20 15:38:32 +02:00
Deborah Servili
6d43d52731
new unnamedthreat actor 2018-09-20 13:24:11 +02:00
Deborah Servili
d0864a6531
new threat actors 2018-09-20 12:10:20 +02:00
Deborah Servili
0a724bee3d
merge 2018-09-19 16:01:46 +02:00
Deborah Servili
3f22dbd17d
add notpetya and update jadeRAT 2018-09-19 15:06:43 +02:00
Deborah Servili
058f778e61
add references 2018-09-19 09:04:04 +02:00
79146b9d10
fix: array in synonyms (MISP accepts it but not the schema ;-) 2018-09-19 07:35:35 +02:00
6105522453
chg: [threat-actor] Iron Group added
ref: https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/
2018-09-19 07:08:16 +02:00
4ae0ccd192
chg: [tool] Xbash added
ref: https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
2018-09-19 07:03:56 +02:00
8238bd5eb1
Merge pull request #263 from botherder/bahamut
Added Bahamut to threat actors list
2018-09-19 06:46:26 +02:00
Deborah Servili
fd960bfc1b
Add magentocore malware 2018-09-18 23:10:33 +02:00
Nex
f0383758fc Added Bahamut to threat actors list 2018-09-18 11:27:32 +02:00
fe60e58f5b
Merge pull request #262 from botherder/mythic-leopard
Added additional name to C-Major
2018-09-18 11:25:58 +02:00
Nex
1e502a494e Added additional name to C-Major 2018-09-18 11:18:42 +02:00
Nex
ee7f609397 Removed duplicates 2018-09-18 11:16:00 +02:00
88c9d8d9f6
Merge pull request #259 from botherder/country-sync
Synced country codes with suspected state sponsor
2018-09-17 18:18:00 +02:00
Nex
be0dd94c90 Synced country codes with suspected state sponsor 2018-09-17 16:26:14 +02:00
Nex
c2ea505459 Merged Transparent Tribe in C-Major 2018-09-17 16:11:18 +02:00
Deborah Servili
ff9409e164
add blacknurse logo 2018-09-13 12:42:01 +02:00
Deborah Servili
1dcf2e50a7
add blacknurse 2018-09-13 12:33:19 +02:00
Deborah Servili
17d3959445
add Crypt0saur ransomware 2018-09-13 11:34:57 +02:00
Deborah Servili
0843fdfb23
adding and updating clusters 2018-09-13 09:03:41 +02:00
Deborah Servili
039fc91bd6
add description for sigma ransomware 2018-09-12 14:27:09 +02:00
Deborah Servili
a73424139f
fix versions 2018-09-12 14:26:44 +02:00
Deborah Servili
f107563cad
add ref for operation Applejeus 2018-09-12 09:34:16 +02:00
Deborah Servili
cb5fa5e822
fix version 2018-09-10 14:21:14 +02:00
Deborah Servili
c92dc15937
add Operation AppleJeus 2018-09-10 14:13:09 +02:00
Deborah Servili
a81bbe288f
fix some relations 2018-09-10 12:27:40 +02:00
Deborah Servili
40d5cca20f
clusters 2018-09-07 16:03:40 +02:00
Deborah Servili
addda6c545
more clusters~ 2018-09-05 16:39:33 +02:00
Deborah Servili
14024efbf1
add CamuBot Banker Trojan 2018-09-05 09:19:35 +02:00
Deborah Servili
5866b660c8
jq~ 2018-09-05 08:29:08 +02:00
Deborah Servili
fb328b0ef4
add ransomwares 2018-09-05 08:20:24 +02:00
Deborah Servili
0a9e91766b Merge branch 'master' of https://github.com/MISP/misp-galaxy 2018-09-04 10:18:07 +02:00
Deborah Servili
912e91a5f5
add ransomware 2018-09-04 09:43:58 +02:00
0acc41131d
"jq all the thing (tm)" 2018-09-01 11:58:52 +02:00
e55f91b7ac
Merge branch 'master' of https://github.com/Kafeine/misp-galaxy into Kafeine-master 2018-09-01 11:56:10 +02:00
Kafeine
ac94f367b1
+ Fallout 2018-09-01 10:07:46 +02:00
Kafeine
21cf5ec957
Hunter EK > Active 2018-08-30 22:47:00 +02:00
Kafeine
85130f264d
Adding Underminer EK 2018-08-30 17:27:59 +02:00
Kafeine
afa3fb4cfd
Status from Terror, Bingo and Astrum 2018-08-30 17:08:37 +02:00
Kafeine
67e9ef2719
Adapting to modification from Misp repository 2018-08-30 17:04:08 +02:00
Deborah Servili
f14dd27315
add cfr data 2018-08-27 15:29:16 +02:00
Deborah Servili
d1940b6a69
Update microsoft-activity-group.json version 2018-08-27 08:38:22 +02:00
Deborah Servili
9efca2fd79 more clusters
Signed-off-by: Deborah Servili <deborah.servili@gmail.com>
2018-08-24 16:11:16 +02:00
Deborah Servili
c943d1c9d1
add APT28/STRONTIUM refs 2018-08-22 09:59:40 +02:00
Deborah Servili
afea4ca5e7 Merge branch 'master' of https://github.com/MISP/misp-galaxy 2018-08-22 09:03:26 +02:00
f8c5640613
chg: [tool] biscuit biscvt tool BISKVIT
ref: https://www.fortinet.com/blog/threat-research/russian-army-exhibition-decoy-leads-to-new-biskvit-malware.html
2018-08-21 10:48:47 +02:00
cd76f19f52
chg: [threat-actor] APT-C-35 actor added
ref: https://ti.360.net/blog/articles/latest-activity-of-apt-c-35/
2018-08-15 20:25:57 +02:00
Deborah Servili
3940964956
update Dharma Ransomware 2018-08-14 15:56:09 +02:00
Deborah Servili
d5f35d94dc
version update 2018-08-14 12:21:50 +02:00
Deborah Servili
f3c02ad195
merge black ruby duplicate (delete the newer) 2018-08-14 12:20:29 +02:00
Deborah Servili
31142b41ac
merge 2018-08-14 12:09:21 +02:00
Deborah Servili
a28c50203e
fix 2018-08-14 12:07:12 +02:00
Deborah Servili
2081dc1627
resolve merge confilct -I hope- 2018-08-14 12:06:42 +02:00
Deborah Servili
4e911b2c17
Merge branch 'master' into master 2018-08-14 11:43:59 +02:00
Deborah Servili
7829e0fab6
fix typo and missing uuid 2018-08-14 11:41:06 +02:00
Deborah Servili
a646a835fe
add Rosenbridge backdoor 2018-08-14 10:09:26 +02:00
Christophe Vandeplas
88162aa44e chg: [mapping] Generated automatic mapping between clusters 2018-08-14 09:35:22 +02:00
Christophe Vandeplas
5478f0aa45 no change: dump files with sort_keys=True
This is needed to keep better track of the changes when other tools load and save the json files.
2018-08-13 17:06:29 +02:00
Christophe Vandeplas
021107e597 fix: [threat-actor] added missing uuids 2018-08-13 17:00:40 +02:00
Deborah Servili
b100b0cedd
add KEYPASS ransomware 2018-08-13 15:50:09 +02:00
Deborah Servili
f1dcb05576
Merge pull request #246 from Delta-Sierra/master
add Skygofree android spyware
2018-08-13 12:28:30 +02:00
Deborah Servili
56fe9eb63c
add Skygofree android spyware 2018-08-13 12:20:16 +02:00
9059a85eed
chg: [tool] KEYMARBLE malware added
ref: https://www.us-cert.gov/ncas/analysis-reports/AR18-221A
2018-08-11 16:14:39 +02:00
Deborah Servili
27805ca768
add tools used by SamSam 2018-08-09 15:55:36 +02:00
Deborah Servili
597e7bacb9
add ransomwares 2018-08-09 13:53:04 +02:00
6620b5575a
fix: [threat-actor] related is an array of JSON objects 2018-08-09 07:53:42 +02:00
1429b60555
chg: [threat-actor] jq document 2018-08-08 16:38:39 +02:00
Deborah Servili
ebc7287e14
update schema 2018-08-08 16:12:29 +02:00
Deborah Servili
33a300b773
tags is an array 2018-08-08 15:59:44 +02:00
Deborah Servili
b857be9cab
relationship system - v2 2018-08-08 15:51:22 +02:00
Deborah Servili
050a864be0
update some clusters and try to add a relationship system 2018-08-08 14:20:38 +02:00
Deborah Servili
84adb50f0f
add RedAlpha campaigns 2018-08-07 13:55:05 +02:00
Deborah Servili
b7de06ffcc
delete forgotten conflict marker 2018-08-06 08:49:44 +02:00
Deborah Servili
010df0a2b6
resolve merge conflict 2018-08-06 08:48:21 +02:00
Deborah Servili
def23775e5
resolve merge conflict 2018-08-06 08:45:03 +02:00
Nils Kuhnert
ab49b58b02
Added DarkHydrus 2018-08-06 08:33:34 +02:00
Nils Kuhnert
4654f51889
Two small typos 2018-08-05 15:09:38 +02:00
Deborah Servili
e5b185deee
Merge branch 'master' into master 2018-08-03 16:11:16 +02:00
Deborah Servili
35aa8ba34e
delete duplicate gorgon group 2018-08-03 16:08:43 +02:00
Deborah Servili
a9a71ef84c
more clusters 2018-08-03 15:58:54 +02:00
b3701b6b34
chg: [threat-actor] The Gordon Group added
ref: https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/
2018-08-03 10:26:52 +02:00
a0dfdd65ae
chg: [rat] Hallaj PRO Rat added
ref: https://securelist.com/attacks-on-industrial-enterprises-using-rms-and-teamviewer/87104/
misp-event: 5b63f5e4-bf24-4f46-8340-48fc02de0b81
2018-08-03 08:34:55 +02:00
3da005a3f3
fix: jq all the things(tm) 2018-08-02 15:15:47 +02:00
1fdf47d509
fix: [threat-actor] synonyms are always arraus 2018-08-02 15:13:18 +02:00
ece56dff38
chg: [threat-actor] leafminer - RASPITE added 2018-08-02 15:08:39 +02:00
c232b3dd5a
chg: [tool] added based on Carbanak tooling description from Crowdstrike
ref: https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/
2018-08-02 10:30:47 +02:00
43fa95df7a
chg: [threat-actor] new reference to CARBON SPIDER/Carbanak 2018-08-02 10:03:18 +02:00
4cf84858e3
chg: [tool] Bisonal malware added (new variant with encryption capabilities) 2018-07-31 15:26:11 +02:00
Deborah Servili
e7d2541929 add Kronos Banking Trojan 2018-07-25 09:46:46 +02:00
Deborah Servili
381f7e4a19 Add CFR.org metadata into the galaxy - part 2 2018-07-25 09:08:16 +02:00
Deborah Servili
28456545be Merge https://github.com/MISP/misp-galaxy 2018-07-16 09:16:13 +02:00
98db303047
chg: [threat-actor] The Big Bang campaign/group added 2018-07-10 08:49:00 +02:00
43a2c7f0ef
chg: [botnet] Xor DDoS added 2018-07-09 14:25:19 +02:00
raw-data
77cfaa8221 [add] new backdoor galaxy and cluster 2018-07-06 20:09:52 +01:00
Raphaël Vinot
e5939e3248 Merge branch 'master' of github.com:MISP/misp-galaxy 2018-07-06 15:25:09 +02:00
Raphaël Vinot
6f7a7921ae new: Add entries from Bambenek Consulting 2018-07-06 15:25:05 +02:00
raw-data
fa8d0e35f6 [add] x1 new entry in stealer.json - AZORult 2018-07-06 11:00:11 +01:00
Deborah Servili
cae0f7e1ad merging attempt 2018-06-29 16:39:34 +02:00
Deborah Servili
8c51ef98b3 add cfr related informations -still in progress- 2018-06-29 16:36:58 +02:00
Deborah Servili
fb6b01cc95
Merge branch 'master' into master 2018-06-27 09:39:28 +02:00
Deborah Servili
b1aac6b35b cfr update -in progress + add clusters associated to RANCOR 2018-06-27 09:37:43 +02:00
1bd0fb34d7
Merge pull request #233 from Delta-Sierra/master
Add CFR.org metadata into the galaxy - Test
2018-06-26 14:26:18 +02:00
Deborah Servili
6f9e639981 add cfr prefix for cfr data - test 2018-06-26 10:07:14 +02:00
Deborah Servili
1cd6bddf0c Add CFR.org metadata into the galaxy - Test 2018-06-26 09:40:13 +02:00
Deborah Servili
3838efb0bb some updates 2018-06-26 09:26:32 +02:00
raw-data
f649af8ba5 [ADD] x1 new entry in tool.json - Koadic 2018-06-25 15:59:30 +01:00
raw-data
b3dffeb8d4 [ADD] x2 new rat - Sisfader, SocketPlayer 2018-06-25 15:46:42 +01:00
raw-data
0920d13c05 [ADD] banker.json version bump 2018-06-25 15:41:32 +01:00
raw-data
b382425d9c [ADD] x2 new banker - Backswap, Karius 2018-06-25 15:14:56 +01:00
Nils Kuhnert
ed26cfb042
Updated APT1 report link 2018-06-22 13:49:05 +02:00
Deborah Servili
8ebde0540a
Update cert-eu-govsector.json 2018-06-22 12:50:32 +02:00
Deborah Servili
e088194ea9
fix typo in type 2018-06-22 12:45:39 +02:00
8e014674af
Fixed typo 2018-06-20 09:45:16 +02:00
Deborah Servili
dcda058944 update verion 2018-06-20 09:36:36 +02:00
Deborah Servili
e18fdf42da add Thrip as threat actor 2018-06-20 09:30:15 +02:00
Deborah Servili
dcd159f8ed add olympic destroyer 2018-06-19 15:26:40 +02:00
Deborah Servili
92cbd29091 add severals ransomware 2018-06-19 13:04:32 +02:00
Deborah Servili
cee83f677e more clusters 2018-06-18 14:30:51 +02:00
Deborah Servili
d8c83cf2d6 add cluster in threat actor 2018-06-18 10:54:58 +02:00
Deborah Servili
ab577afacd add ClipboardWalletHijacker 2018-06-18 09:47:03 +02:00
Deborah Servili
333db20791 add MysteryBot in android galaxy 2018-06-18 08:41:52 +02:00
Deborah Servili
397b37dcc8 add some ransomwares 2018-06-15 15:14:42 +02:00
e6bae7165c
Merge pull request #224 from Delta-Sierra/master
add some clusters
2018-06-13 12:43:35 +02:00
Deborah Servili
4ac23483b9 add some tools 2018-06-13 11:54:50 +02:00
Deborah Servili
cef7d02622 update version 2018-06-13 11:06:31 +02:00
Deborah Servili
c17a2aa7cc add some clusters 2018-06-13 10:39:11 +02:00
Christophe Vandeplas
db81051154 minor layout corrections - validate_all 2018-06-12 11:03:09 +02:00
Christophe Vandeplas
d0d54b2751 merge pull request 222 2018-06-12 10:58:08 +02:00
Deborah Servili
508bb081c8 add BabaYaga Malware 2018-06-08 15:54:30 +02:00
Deborah Servili
2b447585b6 add PLEAD 2018-06-08 10:18:41 +02:00
Kafeine
25d21204fb
fix 2018-06-07 10:34:55 +01:00
Kafeine
52f0858ef5
+ Glazunov 2018-06-07 10:31:58 +01:00
Deborah Servili
a96a8a4a13 add sigrun ransomware's ransomnotes 2018-06-07 09:33:08 +02:00
Kafeine
178d5219c7
guuid & + VenomKit 2018-06-06 18:00:25 +01:00
Deborah Servili
e561e3e4f0 add Sigrun ransomwaremeta data 2018-06-06 16:29:24 +02:00
Deborah Servili
e2a25e165d add Sigrun ransomware 2018-06-06 16:12:31 +02:00
Deborah Servili
07f91bcca4 add another cryptomix variant 2018-06-06 15:44:32 +02:00
Deborah Servili
3e91466aea add Brambul worm 2018-06-06 15:07:30 +02:00
Deborah Servili
3e10d0957c add Joanap RAT 2018-06-06 14:34:42 +02:00
308774755c
add: Iron Backdoor 2018-06-03 18:39:37 +02:00
raw-data
388a2b25b3 [ADD] x2 new info/pwd stealers - Nocturnal Stealer, TeleGrab 2018-06-01 15:59:25 +01:00
raw-data
ba6892408b [ADD] NavRAT 2018-06-01 15:09:22 +01:00
raw-data
42bb2175e2 [ADD] DanaBot 2018-06-01 15:08:55 +01:00
6d5b8de216
Merge branch 'master' of github.com:MISP/misp-galaxy 2018-05-29 21:47:59 +02:00
c08c6af936
chg: Stalker Panda description added 2018-05-29 21:47:04 +02:00
raw-data
8726e0542d [ADD] VPNFilter in tool.json cluster 2018-05-26 23:49:59 +01:00
raw-data
b0396e5ea2 [ADD] Pontoeb, WICKED and Brain Food into botnet.json cluster 2018-05-24 16:39:24 +01:00
Raphaël Vinot
ca964d9d35 Merge branch 'master' of github.com:MISP/misp-galaxy 2018-05-19 17:58:23 -04:00
Raphaël Vinot
96f3bf1cb8 fix: Duplicate ELECTRUM entry
Fix #212
2018-05-19 17:57:51 -04:00
Deborah Servili
22cb1618a5
Merge pull request #214 from Delta-Sierra/master
update mitre galaxies - add external id and killchain
2018-05-19 13:21:18 +02:00
Deborah Servili
6c8edd3f61 jq 2018-05-19 13:09:50 +02:00
Deborah Servili
d82a76c08f fix scripts for nobile and pre attack attack pattern 2018-05-19 13:09:30 +02:00
Deborah Servili
f6d7291e7a jq 2018-05-19 12:57:20 +02:00
Deborah Servili
730353f63d update mitre galaxies - add external id and killchain 2018-05-19 12:56:20 +02:00
3a7c4e3c57
Merge pull request #211 from eCrimeLabs/master
Added links in relation to Threat-actor info from Dragos
2018-05-15 16:17:56 +02:00
9b888f238a
Merge pull request #209 from raw-data/master
[ADD] RadRAT, ARS VBS Loader and FlawedAmmyy into rat.json cluster
2018-05-15 16:17:18 +02:00
Dennis Rand
1ab4e4f4cf Added data related to Dragos Adverseries 2018-05-15 12:06:48 +00:00
Deborah Servili
3d5c697761 add Stalinlocker 2018-05-15 12:27:20 +02:00
Deborah Servili
5b22aa7225 add Mettle botnet 2018-05-14 12:00:22 +02:00
raw-data
0ba6233309 [ADD] RadRAT, ARS VBS Loader and FlawedAmmyy into rat.json cluster 2018-05-11 01:15:35 +01:00
Deborah Servili
5e0bd260d6 update some clusters 2018-05-09 16:12:02 +02:00
Deborah Servili
2b16c86687 add maikspy 2018-05-09 09:52:22 +02:00
Deborah Servili
d3f7f7b591 jq~ 2018-05-09 09:34:08 +02:00
Deborah Servili
360a4d4556 add reference for HNS botnet 2018-05-09 09:29:23 +02:00
Deborah Servili
0d745f6c93 add HNS bot net & HPE iLO 4 Ransomware/Wiper 2018-05-09 09:22:29 +02:00
Deborah Servili
394950379b add Kitty malware 2018-05-07 15:27:29 +02:00
Deborah Servili
1c783a1453 update version -oops- 2018-05-07 08:52:15 +02:00
Deborah Servili
9cf976b2c5 update - GandCrab v3 2018-05-07 08:46:31 +02:00
Deborah Servili
d6e4c166c5 add an unnamed ransomware 2018-05-04 15:59:37 +02:00
Deborah Servili
ba631f1b43 add spymaster pro as rat 2018-05-04 15:12:56 +02:00
Deborah Servili
58e3e5f5d6 add ZooPark campaign 2018-05-04 10:16:01 +02:00
6b1d7d2201
add: threat actors from Dragos Inc. (based on https://dragos.com/adversaries.html) 2018-05-03 21:22:09 +02:00
Deborah Servili
979c784640 jq 2018-05-03 16:08:27 +02:00
Deborah Servili
83581c62b0 add Rubella Macro Builder 2018-05-03 15:38:06 +02:00
Deborah Servili
434716df86 add GravityRAT 2018-05-03 14:35:20 +02:00
Deborah Servili
55504f93d6 add HOGFISH as APT10 synonym 2018-05-03 11:10:21 +02:00
Deborah Servili
9a800ebec1 add Henbox 2018-05-03 10:57:39 +02:00
Deborah Servili
11f0963468 add Orangeworm, Kwampirs, Iron ransomware and Ton ransomware 2018-04-24 10:20:11 +02:00
Deborah Servili
6bf2004bd5 add Muhstik botnet 2018-04-23 09:26:28 +02:00
Stefan Kelm
0b63cb683b NMCRYPT ransomware 2018-04-20 11:28:02 +02:00