{ "Event": { "analysis": "2", "date": "2016-08-18", "extends_uuid": "", "info": "OSINT Snakes in the Satellites: On-going Turla Infrastructure by PassiveTotal", "publish_timestamp": "1498162333", "published": true, "threat_level_id": "2", "timestamp": "1498162260", "uuid": "57b58ade-2da0-4f50-98b3-4846950d210f", "Orgc": { "name": "CthulhuSPRL.be", "uuid": "55f6ea5f-fd34-43b8-ac1d-40cb950d210f" }, "Tag": [ { "colour": "#ffffff", "name": "OSINT" }, { "colour": "#ffffff", "name": "tlp:white" }, { "colour": "#12e200", "name": "misp-galaxy:threat-actor=\"Turla Group\"" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515381", "to_ids": false, "type": "link", "uuid": "57b58af5-e464-4247-8dd6-49bf950d210f", "value": "http://blog.passivetotal.org/snakes-in-the-satellites-on-going-turla-infrastructure/" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515428", "to_ids": false, "type": "link", "uuid": "57b58b24-6fa0-4635-afae-4967950d210f", "value": "https://www.passivetotal.org/certificate/sha1/f415844680ed9118ea74e0c7712b35044f0cc20d" }, { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515428", "to_ids": false, "type": "link", "uuid": "57b58b24-2e74-4f4a-bcca-4828950d210f", "value": "https://www.passivetotal.org/certificate/sha1/fccaea742ed154c9e512da0495a30d79a1b16afd" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515449", "to_ids": true, "type": "ip-dst", "uuid": "57b58b39-6908-4c93-a1a2-4ede950d210f", "value": "78.138.25.24" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515449", "to_ids": true, "type": "ip-dst", "uuid": "57b58b39-446c-44aa-ac48-4e53950d210f", "value": "83.229.103.133" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515449", "to_ids": true, "type": "ip-dst", "uuid": "57b58b39-b48c-421a-a961-4925950d210f", "value": "78.138.25.29" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515450", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3a-97ec-42ba-aa33-41ea950d210f", "value": "83.229.62.179" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515450", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3a-2058-4664-800c-41f4950d210f", "value": "169.255.100.152" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515450", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3a-6114-4cc2-b78c-4c3e950d210f", "value": "83.229.75.141" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515450", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3a-c77c-467c-8f1e-443e950d210f", "value": "78.138.25.19" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515450", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3a-d778-4887-ac6b-4d18950d210f", "value": "169.255.102.246" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515451", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3b-bf38-436e-91c1-412e950d210f", "value": "62.56.130.13" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515451", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3b-ed54-42b4-8c7f-45aa950d210f", "value": "81.199.160.11" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515451", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3b-9dfc-4969-ab37-48fd950d210f", "value": "169.255.101.235" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515451", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3b-4d18-45b3-a328-4523950d210f", "value": "169.255.102.240" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515451", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3b-b9b4-4bce-bfc9-436d950d210f", "value": "78.138.3.182" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515452", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3c-c184-4be0-8a4d-4122950d210f", "value": "169.255.102.110" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515452", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3c-9728-4b19-a732-4f43950d210f", "value": "169.255.100.122" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515452", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3c-d080-46a2-856f-4e22950d210f", "value": "169.255.100.237" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515452", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3c-a79c-47ad-ba73-4be3950d210f", "value": "169.255.101.65" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515452", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3c-706c-4384-bd4c-42e0950d210f", "value": "83.229.103.140" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515453", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3d-b06c-412a-b18b-4051950d210f", "value": "83.229.62.210" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515453", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3d-4450-44af-b0ca-4716950d210f", "value": "83.229.62.206" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515453", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3d-803c-4865-9cd6-4f25950d210f", "value": "83.229.62.249" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515453", "to_ids": true, "type": "ip-dst", "uuid": "57b58b3d-21c4-44c0-a947-42b7950d210f", "value": "81.199.118.4" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515471", "to_ids": true, "type": "x509-fingerprint-sha1", "uuid": "57b58b4f-b4b4-41c2-88dc-4008950d210f", "value": "fccaea742ed154c9e512da0495a30d79a1b16afd" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515486", "to_ids": true, "type": "ip-dst", "uuid": "57b58b5e-e504-4074-9821-4e70950d210f", "value": "209.239.79.29" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515487", "to_ids": true, "type": "ip-dst", "uuid": "57b58b5f-1704-4cb0-b442-4f7b950d210f", "value": "169.255.100.222" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515487", "to_ids": true, "type": "ip-dst", "uuid": "57b58b5f-bce0-45dc-b0b6-496f950d210f", "value": "209.239.79.69" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515487", "to_ids": true, "type": "ip-dst", "uuid": "57b58b5f-493c-4c96-b4eb-4559950d210f", "value": "82.146.174.240" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515487", "to_ids": true, "type": "ip-dst", "uuid": "57b58b5f-6ec4-47f3-8ea7-4ff0950d210f", "value": "82.146.166.61" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515488", "to_ids": true, "type": "ip-dst", "uuid": "57b58b60-0c68-4c3f-8f92-45a0950d210f", "value": "193.220.55.6" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515488", "to_ids": true, "type": "ip-dst", "uuid": "57b58b60-d500-4bfd-9a46-405d950d210f", "value": "83.229.62.212" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515488", "to_ids": true, "type": "ip-dst", "uuid": "57b58b60-30a8-47d3-ada9-4ed6950d210f", "value": "113.208.81.33" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515488", "to_ids": true, "type": "ip-dst", "uuid": "57b58b60-6ac4-4254-ae01-4cf0950d210f", "value": "82.146.174.40" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515488", "to_ids": true, "type": "ip-dst", "uuid": "57b58b60-1f54-46de-ba85-44f7950d210f", "value": "82.146.175.52" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515489", "to_ids": true, "type": "ip-dst", "uuid": "57b58b61-b30c-4466-89c5-44c7950d210f", "value": "113.208.81.48" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515489", "to_ids": true, "type": "ip-dst", "uuid": "57b58b61-a974-4b66-afc7-4e00950d210f", "value": "77.246.76.19" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515489", "to_ids": true, "type": "ip-dst", "uuid": "57b58b61-1570-455b-b88a-4f20950d210f", "value": "209.239.79.121" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515489", "to_ids": true, "type": "ip-dst", "uuid": "57b58b61-b22c-459b-8c7e-4fa4950d210f", "value": "209.239.79.125" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515490", "to_ids": true, "type": "ip-dst", "uuid": "57b58b62-d4e4-4611-8313-4535950d210f", "value": "217.194.150.31" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515490", "to_ids": true, "type": "ip-dst", "uuid": "57b58b62-8e10-43cf-a6cf-47a8950d210f", "value": "82.146.166.58" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515490", "to_ids": true, "type": "ip-dst", "uuid": "57b58b62-2750-4e56-9f2d-4e04950d210f", "value": "217.194.149.111" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515490", "to_ids": true, "type": "ip-dst", "uuid": "57b58b62-3528-4e44-8459-4455950d210f", "value": "193.220.30.72" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515491", "to_ids": true, "type": "ip-dst", "uuid": "57b58b63-1988-4343-a4fa-4852950d210f", "value": "77.246.78.224" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515491", "to_ids": true, "type": "ip-dst", "uuid": "57b58b63-a5b0-4e20-b51d-4405950d210f", "value": "92.62.221.47" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515491", "to_ids": true, "type": "ip-dst", "uuid": "57b58b63-ad58-4704-8807-4049950d210f", "value": "113.208.81.55" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515491", "to_ids": true, "type": "ip-dst", "uuid": "57b58b63-9928-4c5a-aa35-439b950d210f", "value": "31.209.133.125" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515491", "to_ids": true, "type": "ip-dst", "uuid": "57b58b63-57dc-4d6e-a284-458c950d210f", "value": "217.8.36.239" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515492", "to_ids": true, "type": "ip-dst", "uuid": "57b58b64-3b7c-48bf-ba42-4d2d950d210f", "value": "82.146.175.48" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515492", "to_ids": true, "type": "ip-dst", "uuid": "57b58b64-1d04-43bf-b310-4618950d210f", "value": "82.146.175.69" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515492", "to_ids": true, "type": "ip-dst", "uuid": "57b58b64-6620-4096-9835-493c950d210f", "value": "82.146.175.29" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515492", "to_ids": true, "type": "ip-dst", "uuid": "57b58b64-df98-4d09-adbb-462c950d210f", "value": "41.203.79.74" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515492", "to_ids": true, "type": "ip-dst", "uuid": "57b58b64-1f5c-4771-9a2a-4d64950d210f", "value": "77.73.187.223" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515493", "to_ids": true, "type": "ip-dst", "uuid": "57b58b65-51f4-4bc7-ae9a-40ab950d210f", "value": "217.194.150.22" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515513", "to_ids": true, "type": "x509-fingerprint-sha1", "uuid": "57b58b79-5578-4825-a05c-4377950d210f", "value": "f415844680ed9118ea74e0c7712b35044f0cc20d" }, { "category": "Attribution", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1471515528", "to_ids": false, "type": "threat-actor", "uuid": "57b58b88-c9f8-482e-bcfc-42f4950d210f", "value": "Turla" } ] } }