misp-galaxy/clusters/mitre-pre-attack-intrusion-set.json

{
  "name": "Pre Attack - intrusion Set",
  "type": "mitre-pre-attack-intrusion-set",
  "description": "Name of ATT&CK Group",
  "version": 2,
  "source": "https://github.com/mitre/cti",
  "uuid": "1fdc8fa2-1708-11e8-99a3-67b4efc13c4f",
  "authors": [
    "MITRE"
  ],
  "values": [
    {
      "description": "APT16 is a China-based threat group that has launched spearphishing campaigns targeting Japanese and Taiwanese organizations. (Citation: FireEye EPS Awakens Part 2)",
      "value": "APT16 - G0023",
      "meta": {
        "synonyms": [
          "APT16"
        ],
        "refs": [
          "https://attack.mitre.org/wiki/Group/G0023",
          "https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"
        ]
      },
      "uuid": "d6e88e18-81e8-4709-82d8-973095da1e70"
    },
    {
      "description": "APT28 is a threat group that has been attributed to the Russian government. (Citation: FireEye APT28) (Citation: SecureWorks TG-4127) (Citation: FireEye APT28) January 2017 (Citation: GRIZZLY STEPPE JAR) This group reportedly compromised the Democratic National Committee in April 2016. (Citation: Crowdstrike DNC June 2016)",
      "value": "APT28 - G0007",
      "meta": {
        "synonyms": [
          "APT28",
          "Sednit",
          "Sofacy",
          "Pawn Storm",
          "Fancy Bear",
          "STRONTIUM",
          "Tsar Team",
          "Threat Group-4127",
          "TG-4127"
        ],
        "refs": [
          "https://attack.mitre.org/wiki/Group/G0007",
          "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/",
          "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf",
          "https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign"
        ]
      },
      "uuid": "bef4c620-0787-42a8-a96d-b7eb6e85917c"
    },
    {
      "description": "Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)",
      "value": "Cleaver - G0003",
      "meta": {
        "synonyms": [
          "Cleaver",
          "TG-2889",
          "Threat Group 2889"
        ],
        "refs": [
          "https://attack.mitre.org/wiki/Group/G0003",
          "https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance%20Operation%20Cleaver%20Report.pdf",
          "http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/"
        ]
      },
      "uuid": "8f5e8dc7-739d-4f5e-a8a1-a66e004d7063"
    },
    {
      "description": "APT12 is a threat group that has been attributed to China. (Citation: Meyers Numbered Panda)",
      "value": "APT12 - G0005",
      "meta": {
        "synonyms": [
          "APT12",
          "IXESHE",
          "DynCalc",
          "Numbered Panda",
          "DNSCALC"
        ],
        "refs": [
          "https://attack.mitre.org/wiki/Group/G0005",
          "http://www.crowdstrike.com/blog/whois-numbered-panda/"
        ]
      },
      "uuid": "c47f937f-1022-4f42-8525-e7a4779a14cb"
    },
    {
      "description": "APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)",
      "value": "APT1 - G0006",
      "meta": {
        "synonyms": [
          "APT1",
          "Comment Crew",
          "Comment Group",
          "Comment Panda"
        ],
        "refs": [
          "https://attack.mitre.org/wiki/Group/G0006",
          "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        ]
      },
      "uuid": "6a2e693f-24e5-451a-9f88-b36a108e5662"
    },
    {
      "description": "Night Dragon is a threat group that has conducted activity originating primarily in China. (Citation: McAfee Night Dragon)",
      "value": "Night Dragon - G0014",
      "meta": {
        "synonyms": [
          "Night Dragon"
        ],
        "refs": [
          "https://attack.mitre.org/wiki/Group/G0014",
          "http://www.mcafee.com/us/resources/white-papers/wp-global-energy-cyberattacks-night-dragon.pdf"
        ]
      },
      "uuid": "23b6a0f5-fa95-46f9-a6f3-4549c5e45ec8"
    },
    {
      "description": "APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. (Citation: FireEye APT17)",
      "value": "APT17 - G0025",
      "meta": {
        "synonyms": [
          "APT17",
          "Deputy Dog"
        ],
        "refs": [
          "https://attack.mitre.org/wiki/Group/G0025",
          "https://www2.fireeye.com/rs/fireye/images/APT17%20Report.pdf"
        ]
      },
      "uuid": "090242d7-73fc-4738-af68-20162f7a5aae"
    }
  ]
}