45 lines
2.6 KiB
JSON
45 lines
2.6 KiB
JSON
{
|
|
"id": "bundle--96a6ea7a-fcff-4aab-925b-a494bcdf0480",
|
|
"objects": [
|
|
{
|
|
"aliases": [
|
|
"DragonOK"
|
|
],
|
|
"created": "2017-05-31T21:31:53.197755Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"description": "DragonOK is a threat group that has targeted Japanese organizations with phishing emails. Due to overlapping TTPs, including similar custom tools, DragonOK is thought to have a direct or indirect relationship with the threat group Moafee. [[Citation: Operation Quantum Entanglement]][[Citation: Symbiotic APT Groups]] It is known to use a variety of malware, including Sysget/HelloBridge, PlugX, PoisonIvy, FormerFirstRat, NFlog, and NewCT. [[Citation: New DragonOK]]",
|
|
"external_references": [
|
|
{
|
|
"external_id": "G0017",
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/wiki/Group/G0017"
|
|
},
|
|
{
|
|
"description": "Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 4, 2015.",
|
|
"source_name": "Operation Quantum Entanglement",
|
|
"url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf"
|
|
},
|
|
{
|
|
"description": "Haq, T. (2014, October). An Insight into Symbiotic APT Groups. Retrieved November 4, 2015.",
|
|
"source_name": "Symbiotic APT Groups",
|
|
"url": "https://dl.mandiant.com/EE/library/MIRcon2014/MIRcon%202014%20R&D%20Track%20Insight%20into%20Symbiotic%20APT.pdf"
|
|
},
|
|
{
|
|
"description": "Miller-Osborn, J., Grunzweig, J.. (2015, April). Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets. Retrieved November 4, 2015.",
|
|
"source_name": "New DragonOK",
|
|
"url": "http://researchcenter.paloaltonetworks.com/2015/04/unit-42-identifies-new-dragonok-backdoor-malware-deployed-against-japanese-targets/"
|
|
}
|
|
],
|
|
"id": "intrusion-set--f3bdec95-3d62-42d9-a840-29630f6cdc1a",
|
|
"modified": "2017-05-31T21:31:53.197755Z",
|
|
"name": "DragonOK",
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"type": "intrusion-set"
|
|
}
|
|
],
|
|
"spec_version": "2.0",
|
|
"type": "bundle"
|
|
}
|