From 19491649f215fe5b79d9b5b314168517f3ae297d Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Tue, 19 Nov 2024 07:56:46 -0800 Subject: [PATCH] [threat-actors] Add BrazenBamboo --- clusters/threat-actor.json | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 6d423b69..23b98e75 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -17443,6 +17443,17 @@ }, "uuid": "4d3c9666-6e08-4186-854c-cc0f8c28f5b6", "value": "Kairos" + }, + { + "description": "BrazenBamboo is a Chinese state-affiliated threat actor known for developing the LIGHTSPY, DEEPDATA, and DEEPPOST malware families. Their infrastructure includes capabilities for zero-day exploitation, specifically targeting vulnerabilities like FortiClient, and employs a command-and-control architecture that supports multi-platform operations. Volexity's analysis indicates that BrazenBamboo is a well-resourced entity with a focus on domestic targets, utilizing custom analyst software to manage data collected from their malware. The ongoing development of their malware families is evidenced by the timestamps associated with their latest payloads.", + "meta": { + "country": "CN", + "refs": [ + "https://www.volexity.com/blog/2024/11/15/brazenbamboo-weaponizes-forticlient-vulnerability-to-steal-vpn-credentials-via-deepdata/" + ] + }, + "uuid": "305fbff0-d3ff-43e3-8741-63bad68e47ee", + "value": "BrazenBamboo" } ], "version": 320