From 20e77afcc318955bf19494236de788009805dfc1 Mon Sep 17 00:00:00 2001 From: Deborah Servili Date: Thu, 13 Jun 2019 16:19:21 +0200 Subject: [PATCH] update threat actor galaxy --- clusters/threat-actor.json | 61 +++++++++++++++++++++++++++++++------- 1 file changed, 50 insertions(+), 11 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index a9c32cd..26c6667 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -100,7 +100,9 @@ "attribution-confidence": "50", "country": "CN", "refs": [ - "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the_nitro_attacks.pdf" + "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the_nitro_attacks.pdf", + "https://unit42.paloaltonetworks.com/new-indicators-compromise-apt-group-nitro-uncovered/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/the-significance-of-the-nitro-attacks/" ], "synonyms": [ "Covert Grove" @@ -804,7 +806,12 @@ "refs": [ "https://securelist.com/analysis/publications/69953/the-naikon-apt/", "https://www.fireeye.com/blog/threat-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html", - "https://www.cfr.org/interactive/cyber-operations/apt-30" + "https://www.cfr.org/interactive/cyber-operations/apt-30", + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf", + "https://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/", + "https://securelist.com/the-chronicles-of-the-hellsing-apt-the-empire-strikes-back/69567/", + "https://threatconnect.com/tag/naikon/", + "https://attack.mitre.org/groups/G0019/" ], "synonyms": [ "PLA Unit 78020", @@ -813,7 +820,8 @@ "Override Panda", "Camerashy", "APT.Naikon", - "Lotus Panda" + "Lotus Panda", + "Hellsing" ] }, "related": [ @@ -1171,7 +1179,9 @@ "attribution-confidence": "50", "country": "CN", "refs": [ - "https://kc.mcafee.com/corporate/index?page=content&id=KB71150" + "https://kc.mcafee.com/corporate/index?page=content&id=KB71150", + "https://securingtomorrow.mcafee.com/wp-content/uploads/2011/02/McAfee_NightDragon_wp_draft_to_customersv1-1.pdf", + "https://attack.mitre.org/groups/G0014/" ] }, "related": [ @@ -1327,10 +1337,16 @@ "country": "CN", "refs": [ "https://securelist.com/blog/research/35936/nettraveler-is-running-red-star-apt-attacks-compromise-high-profile-victims/", - "https://www.cfr.org/interactive/cyber-operations/nettraveler" + "https://www.cfr.org/interactive/cyber-operations/nettraveler", + "https://www.kaspersky.com/about/press-releases/2013_kaspersky-lab-uncovers--operation-nettraveler--a-global-cyberespionage-campaign-targeting-government-affiliated-organizations-and-research-institutes", + "https://www.kaspersky.com/about/press-releases/2014_nettraveler-gets-a-makeover-for-10th-anniversary", + "https://unit42.paloaltonetworks.com/nettraveler-spear-phishing-email-targets-diplomat-of-uzbekistan/", + "https://www.proofpoint.com/us/threat-insight/post/nettraveler-apt-targets-russian-european-interests" ], "synonyms": [ - "APT 21" + "APT 21", + "APT21", + "TravNet" ] }, "uuid": "b80f4788-ccb2-466d-ae16-b397159d907e", @@ -3658,13 +3674,33 @@ "https://www.cfr.org/interactive/cyber-operations/oilrig", "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/", "https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/", - "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/" + "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/", + "https://www.symantec.com/connect/blogs/shamoon-attacks", + "https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html", + "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/", + "https://www.symantec.com/connect/blogs/shamoon-back-dead-and-destructive-ever", + "https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/", + "https://unit42.paloaltonetworks.com/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/", + "https://www.clearskysec.com/oilrig/", + "https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/", + "https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/", + "https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html", + "https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/", + "https://unit42.paloaltonetworks.com/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/", + "https://www.symantec.com/blogs/threat-intelligence/shamoon-destructive-threat-re-emerges-new-sting-its-tail", + "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/shamoon-attackers-employ-new-tool-kit-to-wipe-infected-systems/", + "https://unit42.paloaltonetworks.com/unit42-striking-oil-closer-look-adversary-infrastructure/", + "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/", + "https://attack.mitre.org/groups/G0049/" ], "synonyms": [ "Twisted Kitten", "Cobalt Gypsy", "Crambus", - "Helix Kitten" + "Helix Kitten", + "APT 34", + "APT34", + "IRN2" ] }, "related": [ @@ -3837,7 +3873,9 @@ "country": "TR", "refs": [ "https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/", - "https://www.virusbulletin.com/conference/vb2016/abstracts/last-minute-paper-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users" + "https://www.virusbulletin.com/conference/vb2016/abstracts/last-minute-paper-strongpity-waterhole-attacks-targeting-italian-and-belgian-encryption-users", + "https://www.microsoft.com/security/blog/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/", + "https://attack.mitre.org/groups/G0055/" ], "synonyms": [ "StrongPity" @@ -6239,7 +6277,7 @@ "value": "HenBox" }, { - "description": "This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes.", + "description": "This threat actor targets nongovernmental organizations using Mongolian-themed lures for espionage purposes.\nIn April 2017, CrowdStrike Falcon Intelligence observed a previously unattributed actor group with a Chinese nexus targeting a U.S.-based think tank. Further analysis revealed a wider campaign with unique tactics, techniques, and procedures (TTPs). This adversary targets non-governmental organizations (NGOs) in general, but uses Mongolian language decoys and themes, suggesting this actor has a specific focus on gathering intelligence on Mongolia. These campaigns involve the use of shared malware like Poison Ivy or PlugX.\nRecently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files.", "meta": { "attribution-confidence": "50", "cfr-suspected-state-sponsor": "China", @@ -6252,7 +6290,8 @@ "cfr-type-of-incident": "Espionage", "country": "CN", "refs": [ - "https://www.cfr.org/interactive/cyber-operations/mustang-panda" + "https://www.cfr.org/interactive/cyber-operations/mustang-panda", + "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/" ] }, "uuid": "78bf726c-a9e6-11e8-9e43-77249a2f7339",