789 lines
33 KiB
JSON
789 lines
33 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--fba1fa66-183d-4e82-bb89-78bfcb4d6e29",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-24T13:17:48.000Z",
|
||
|
|
"modified": "2022-10-24T13:17:48.000Z",
|
||
|
|
"name": "Centre for Cyber security Belgium",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--fba1fa66-183d-4e82-bb89-78bfcb4d6e29",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-24T13:17:48.000Z",
|
||
|
|
"modified": "2022-10-24T13:17:48.000Z",
|
||
|
|
"name": "OSINT of Exchange 0-day campaign (Atos)",
|
||
|
|
"published": "2024-05-31T11:03:45Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--ba307599-e813-4e5f-94ff-f4e36fd71d41",
|
||
|
|
"indicator--de4ccfb9-0453-4b83-93ca-80893d086abb",
|
||
|
|
"indicator--61be67f9-ec2a-4429-8161-f09e7cba0905",
|
||
|
|
"indicator--5c05c0b0-0cc8-4446-a4c8-335b9ffa085f",
|
||
|
|
"indicator--bf62496c-e4ad-49cc-bff7-53235eba9c76",
|
||
|
|
"indicator--ae79c28f-487c-4652-9b7e-71637cd2e8e9",
|
||
|
|
"indicator--1890b51c-0238-4495-93ee-634cb4f9e869",
|
||
|
|
"indicator--0238308c-bf90-4503-906b-fca2d4e2f060",
|
||
|
|
"indicator--3a1765c3-086d-4a3d-b404-ce336f2600b0",
|
||
|
|
"indicator--82c5c66e-934c-4f00-afa9-26e148296ba1",
|
||
|
|
"indicator--e1cadeb5-bef6-41b3-ae08-7aa7946f4589",
|
||
|
|
"indicator--a8591697-e631-48c7-b2c7-feea313372c9",
|
||
|
|
"indicator--d98d097f-cadb-440e-b172-37799f9f4fd7",
|
||
|
|
"indicator--116795b5-4ebd-4792-8116-b220518aed43",
|
||
|
|
"indicator--f6f0cc0c-c369-41dd-9f8f-dc941b9d0cc1",
|
||
|
|
"indicator--9b57c1c2-dc85-478a-b1ec-7bb6a587e03f",
|
||
|
|
"indicator--d21024e3-6ee7-4939-b808-9e545cad0331",
|
||
|
|
"indicator--5c2ab9b0-db03-494b-b621-3ac188bf3f7d",
|
||
|
|
"indicator--ce3af728-e3b9-4f40-846f-f03cb1a28327",
|
||
|
|
"indicator--2c77ecad-aada-42a2-9696-c27a56506ed6",
|
||
|
|
"indicator--d4092f08-8029-4e76-9055-2607dee1781f",
|
||
|
|
"indicator--e4687f58-79d8-4d06-a8a9-8ecbf8d4d0d2",
|
||
|
|
"indicator--d768ea49-139f-4dcf-8af5-4e837888c5fb",
|
||
|
|
"indicator--fdbc158a-2253-4cb3-af63-2eed91f6cf2e",
|
||
|
|
"indicator--29466e30-8056-4cd3-89b0-bc6aa16b48f3",
|
||
|
|
"indicator--83fd3c39-85b1-4e21-9735-9a006ddabc01",
|
||
|
|
"indicator--91b7b424-d362-49a1-b9f4-494cfe17b960",
|
||
|
|
"indicator--5053b6b1-6a3a-4a23-8560-fb69b72ba8a8",
|
||
|
|
"x-misp-object--239abc6c-9a8a-4fe5-8b09-14b2ee4c570b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"tlp:clear",
|
||
|
|
"admiralty-scale:source-reliability=\"b\"",
|
||
|
|
"Microsoft Exchange Vulnerability",
|
||
|
|
"Zero Day",
|
||
|
|
"OSINT",
|
||
|
|
"osint:source-type=\"blog-post\"",
|
||
|
|
"cert-ist:threat_targeted_sector=\"Gov\"",
|
||
|
|
"misp-galaxy:financial-fraud=\"Spear phishing\"",
|
||
|
|
"cert-ist:threat_targeted_sector=\"Media\"",
|
||
|
|
"misp-galaxy:sector=\"Government, Administration\"",
|
||
|
|
"misp-galaxy:region=\"142 - Asia\"",
|
||
|
|
"misp-galaxy:region=\"150 - Europe\"",
|
||
|
|
"admiralty-scale:information-credibility=\"3\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ba307599-e813-4e5f-94ff-f4e36fd71d41",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '206.188.196.77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--de4ccfb9-0453-4b83-93ca-80893d086abb",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'rkn-redirect.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--61be67f9-ec2a-4429-8161-f09e7cba0905",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'mail.ticaret.gov.tr-redirect.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c05c0b0-0cc8-4446-a4c8-335b9ffa085f",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '162.33.179.130']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--bf62496c-e4ad-49cc-bff7-53235eba9c76",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[email-message:from_ref.value = 'vpscontrollervnc@protonmail.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-src\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ae79c28f-487c-4652-9b7e-71637cd2e8e9",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'openattachment.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--1890b51c-0238-4495-93ee-634cb4f9e869",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'openingfile.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--0238308c-bf90-4503-906b-fca2d4e2f060",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'northapollon.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--3a1765c3-086d-4a3d-b404-ce336f2600b0",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'openfile-attachment.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--82c5c66e-934c-4f00-afa9-26e148296ba1",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:38.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:38.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'united-nation-news.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e1cadeb5-bef6-41b3-ae08-7aa7946f4589",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'byannika.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--a8591697-e631-48c7-b2c7-feea313372c9",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[email-message:from_ref.value = 'netxv@bk.ru']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-src\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d98d097f-cadb-440e-b172-37799f9f4fd7",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'tr-redirect.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--116795b5-4ebd-4792-8116-b220518aed43",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'web-document.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--f6f0cc0c-c369-41dd-9f8f-dc941b9d0cc1",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.20.40.95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--9b57c1c2-dc85-478a-b1ec-7bb6a587e03f",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '168.100.10.30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d21024e3-6ee7-4939-b808-9e545cad0331",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'mfa-tj.download']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2ab9b0-db03-494b-b621-3ac188bf3f7d",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'akipress.news']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ce3af728-e3b9-4f40-846f-f03cb1a28327",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'mail.antikor.gov.kz.openingfile.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--2c77ecad-aada-42a2-9696-c27a56506ed6",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'mail.gov.kg.openingfile.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d4092f08-8029-4e76-9055-2607dee1781f",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'mail.agro.gov.kg.openingfile.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--e4687f58-79d8-4d06-a8a9-8ecbf8d4d0d2",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'telegram.akipress.news']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d768ea49-139f-4dcf-8af5-4e837888c5fb",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'mail.mfa.gov.kg.openingfile.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--fdbc158a-2253-4cb3-af63-2eed91f6cf2e",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'mail.aop.gov.af.openingfile.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--29466e30-8056-4cd3-89b0-bc6aa16b48f3",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[email-message:from_ref.value = 'account0021@protonmail.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-src\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--83fd3c39-85b1-4e21-9735-9a006ddabc01",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'auth0rization.cloud']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--91b7b424-d362-49a1-b9f4-494cfe17b960",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'united-nations-news.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5053b6b1-6a3a-4a23-8560-fb69b72ba8a8",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-03T14:16:39.000Z",
|
||
|
|
"modified": "2022-10-03T14:16:39.000Z",
|
||
|
|
"description": "Used as part of targeted attacks against government sectors",
|
||
|
|
"pattern": "[domain-name:value = 'application-download.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2022-10-03T14:16:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--239abc6c-9a8a-4fe5-8b09-14b2ee4c570b",
|
||
|
|
"created_by_ref": "identity--5cf66e53-b5f8-43e7-be9a-49880a3b4631",
|
||
|
|
"created": "2022-10-24T13:11:26.000Z",
|
||
|
|
"modified": "2022-10-24T13:11:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"annotation\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "creation-date",
|
||
|
|
"value": "2022-10-03T00:00:00+00:00",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "9b07c0fa-65f5-437b-8f2e-4e3a8e939826"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "ref",
|
||
|
|
"value": "https://atos.net/en/lp/security-dive-blog-vulnerability-0-day-exchange",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "9b630af7-92a2-4e22-aa39-9b7b253cfd8d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "text",
|
||
|
|
"value": "Reports of new 0-day vulnerabilities electrify the Cybersecurity community, especially when they affect commonly used products. Recent news about the successor of the infamous ProxyShell -CVE-2022-41040, CVE-2022-41082 \u2013 found in Microsoft Exchange and disclosed by researchers at GTSC Research Lab on 28/09/2022 pushed our TI operations to understand the attackers\u2019 infrastructure better. Our brief analysis is evidence that it is worthwhile to do enrichment of available IOCs to build additional context and try to determine the motivations and origins of threat actors.",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "decb8987-f071-416c-86f9-08f11b0aad32"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "type",
|
||
|
|
"value": "Full Report",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "0b930c20-ddbb-4092-941e-5ef42965783e"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "annotation"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|