misp-circl-feed/feeds/circl/misp/5d832d9f-1508-4fdf-979b-4edf950d210f.json

{"Event": {"info": "OSINT - Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks", "Tag": [{"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:malpedia=\"OilRig\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"OilRig\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"OilRig - G0049\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:mitre-intrusion-set=\"OilRig\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:mitre-intrusion-set=\"OilRig - G0049\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:threat-actor=\"CHRYSENE\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:threat-actor=\"OilRig\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT34\""}, {"colour": "#0088cc", "exportable": true, "name": "misp-galaxy:threat-actor=\"APT34\""}, {"colour": "#72003d", "exportable": true, "name": "workflow:todo=\"add-missing-misp-galaxy-cluster-values\""}, {"colour": "#3b0020", "exportable": true, "name": "workflow:todo=\"expansion\""}, {"colour": "#004646", "exportable": true, "name": "type:OSINT"}, {"colour": "#0071c3", "exportable": true, "name": "osint:lifetime=\"perpetual\""}, {"colour": "#0087e8", "exportable": true, "name": "osint:certainty=\"50\""}, {"colour": "#ffffff", "exportable": true, "name": "tlp:white"}], "publish_timestamp": "0", "timestamp": "1568986366", "Object": [{"comment": "", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "uuid": "5d84c63f-ad44-40aa-85f6-41fa950d210f", "sharing_group_id": "0", "timestamp": "1568982591", "description": "File object describing a file with meta-information", "template_version": "17", "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "5d84c63f-5df8-471b-8375-4aae950d210f", "timestamp": "1568982591", "to_ids": true, "value": "%Windir%\\temp\\rconfig.xml", "disable_correlation": true, "object_relation": "filename", "type": "filename"}], "distribution": "5", "meta-category": "file", "name": "file"}, {"comment": "", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "uuid": "5d84ca7f-8904-4b83-aa2d-4efd950d210f", "sharing_group_id": "0", "timestamp": "1568983679", "description": "File object describing a file with meta-information", "template_version": "17", "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "5d84ca80-5a7c-4ac8-b7e5-4cca950d210f", "timestamp": "1568983680", "to_ids": true, "value": "d9ac9c950e5495c9005b04843a40f01fa49d5fd49226cb5b03a055232ffc36f3", "disable_correlation": false, "object_relation": "sha256", "type": "sha256"}], "distribution": "5", "meta-category": "file", "name": "file"}, {"comment": " Backdoor.Syskit ", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "uuid": "5d84d359-b914-4b54-8a37-42cb950d210f", "sharing_group_id": "0", "timestamp": "1568985945", "description": "File object describing a file with meta-information", "template_version": "17", "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "5d84d359-24e0-4711-b112-4784950d210f", "timestamp": "1568985945", "to_ids": true, "value": "f71732f997c53fa45eef5c988697eb4aa62c8655d8f0be3268636fc23addd193", "disable_correlation": false, "object_relation": "sha256", "type": "sha256"}], "distribution": "5", "meta-category": "file", "name": "file"}, {"comment": " Backdoor.Syskit ", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "uuid": "5d84d370-6c2c-4918-80bd-4a01950d210f", "sharing_group_id": "0", "timestamp": "1568985968", "description": "File object describing a file with meta-information", "template_version": "17", "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "5d84d370-3be8-4941-ac15-44ec950d210f", "timestamp": "1568985968", "to_ids": true, "value": "02a3296238a3d127a2e517f4949d31914c15d96726fb4902322c065153b364b2", "disable_correlation": false, "object_relation": "sha256", "type": "sha256"}], "distribution": "5", "meta-category": "file", "name": "file"}, {"comment": " Backdoor.Syskit ", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "uuid": "5d84d38e-6880-4ffc-b9d8-4ae3950d210f", "sharing_group_id": "0", "timestamp": "1568985998", "description": "File object describing a file with meta-information", "template_version": "17", "Attribute": [{"comment": "", "category": "Payload delivery", "uuid": "5d84d38e-50dc-49f7-b67a-40ca950d210f", "timestamp": "1568985998", "to_ids": true, "value": "07d123364d8d04e3fe0bfa4e0e23ddc7050ef039602ecd72baed70e6553c3ae4", "disable_correlation": false, "object_relation": "sha256", "type": "sha256"}], "distribution": "5", "meta-category": "file", "name": "file"}], "analysis": "0", "Attribute": [{"comment": "", "category": "External analysis", "uuid": "5d832dc2-67e4-4561-84eb-42b1950d210f", "timestamp": "1568878018", "to_ids": false, "value": "https://www.symantec.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain", "disable_correlation": false, "object_relation": null, "type": "link"}, {"comment": "", "category": "External analysis", "uuid": "5d832de7-7b14-4ee6-9ac2-4471950d210f", "timestamp": "1568878055", "to_ids": false, "value": "Previously undocumented group hits IT providers in the Middle East.\r\n\r\nA previously undocumented attack group is using both custom and off-the-shelf malware to target IT providers in Saudi Arabia in what appear to be supply chain attacks with the end goal of compromising the IT providers\u2019 customers.\r\n\r\nThe group, which we are calling Tortoiseshell, has been active since at least July 2018. Symantec has identified a total of 11 organizations hit by the group, the majority of which are based in Saudi Arabia. In at least two organizations, evidence suggests that the attackers gained domain admin-level access.\r\n\r\nAnother notable element of this attack is that, on two of the compromised networks, several hundred computers were infected with malware. This is an unusually large number of computers to be compromised in a targeted attack. It is possible that the attackers were forced to infect many machines before finding those that were of most interest to them.\r\n\r\nWe have seen Tortoiseshell activity as recently as July 2019.", "disable_correlation": false, "object_relation": null, "type": "text"}, {"comment": "", "category": "Persistence mechanism", "uuid": "5d84c794-428c-41c9-b743-4270950d210f", "timestamp": "1568982932", "to_ids": false, "value": "HKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\policies\\system\\Enablevmd", "disable_correlation": false, "object_relation": null, "type": "regkey"}, {"comment": "", "category": "Persistence mechanism", "uuid": "5d84c79b-4ac8-4fd1-b315-4082950d210f", "timestamp": "1568982939", "to_ids": false, "value": "HKEY_LOCAL_MACHINE\\software\\microsoft\\windows\\currentversion\\policies\\system\\Sendvmd", "disable_correlation": false, "object_relation": null, "type": "regkey"}, {"comment": "", "category": "Network activity", "uuid": "5d84c9ca-1130-43f5-8418-42c6950d210f", "timestamp": "1568983498", "to_ids": true, "value": "Infostealer/Sha.exe/Sha432.exe", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Network activity", "uuid": "5d84c9ca-62cc-4f84-819a-49d7950d210f", "timestamp": "1568983498", "to_ids": true, "value": "Infostealer/stereoversioncontrol.exe", "disable_correlation": false, "object_relation": null, "type": "url"}, {"comment": "", "category": "Payload delivery", "uuid": "5d84c9ca-1bb8-4553-b847-4da7950d210f", "timestamp": "1568983498", "to_ids": true, "value": "get-logon-history.ps1", "disable_correlation": false, "object_relation": null, "type": "filename"}, {"comment": "Backdoor.Syskit C&C server", "category": "Network activity", "uuid": "5d84d3a3-66b8-4242-9876-4fb9950d210f", "timestamp": "1568986019", "to_ids": true, "value": "64.235.60.123", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}, {"comment": "Backdoor.Syskit C&C server", "category": "Network activity", "uuid": "5d84d3a3-5158-4760-955b-49e0950d210f", "timestamp": "1568986019", "to_ids": true, "value": "64.235.39.45", "disable_correlation": false, "object_relation": null, "type": "ip-dst"}], "extends_uuid": "", "published": false, "date": "2019-09-18", "Orgc": {"uuid": "55f6ea5e-2c60-40e5-964f-47a8950d210f", "name": "CIRCL"}, "threat_level_id": "3", "uuid": "5d832d9f-1508-4fdf-979b-4edf950d210f"}}