MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #535 from ITAYC0HEN/feature/AddDarkUniverseActor 

Add ItaDuke/DarkUniverse actor
pull/536/head
Alexandre Dulaunoy 2020-04-23 11:22:39 +02:00 committed by GitHub
parent 2a5ea5f521 667d5b8850
commit 13348879cc
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
clusters/threat-actor.json
View File

@ -8098,6 +8098,22 @@
},
"uuid": "86b4e2f3-8bbf-48fd-9d27-034d3ac3b187",
"value": "VENOM SPIDER"
},
{
"description": "ItaDuke is an actor known since 2013. It used PDF exploits for dropping malware and Twitter accounts to store C2 server urls. On 2018, an actor named DarkUniverse, which was active between 2009 to 2017, was attributed to this ItaDuke by Kaspersky.",
"meta": {
"refs": [
"https://securelist.com/darkuniverse-the-mysterious-apt-framework-27/94897/",
"https://www.fireeye.com/blog/threat-research/2013/02/the-number-of-the-beast.html",
"https://securelist.com/new-uyghur-and-tibetan-themed-attacks-using-pdf-exploits/35465"
],
"synonyms": [
"DarkUniverse",
"SIG27"
]
},
"uuid": "d0b900fa-84b4-11ea-bc55-0242ac130003",
"value": "ItaDuke"
}
],
"version": 157