Merge pull request #46 from Delta-Sierra/master

Add some tools/threat actor

clusters/threat-actor.json

@@ -1512,6 +1512,15 @@
       },
       "value": "Longhorn",
       "description": "Longhorn has been active since at least 2011. It has used a range of back door Trojans in addition to zero-day vulnerabilities to compromise its targets. Longhorn has infiltrated governments and internationally operating organizations, in addition to targets in the financial, telecoms, energy, aerospace, information technology, education, and natural resources sectors. All of the organizations targeted would be of interest to a nation-state attacker.  Longhorn has infected 40 targets in at least 16 countries across the Middle East, Europe, Asia, and Africa. On one occasion a computer in the United States was compromised but, following infection, an uninstaller was launched within hours, which may indicate this victim was infected unintentionally."
+    },
+    {
+      "meta": {
+        "refs": [
+          "https://www.f-secure.com/documents/996508/1030745/callisto-group"
+        ]
+      },
+      "value": "Callisto",
+      "description": "The Callisto Group  is an advanced threat actor whose known targets include military personnel, government officials, think tanks, and journalists in Europe and the South Caucasus. Their primary interest appears to be gathering intelligence related to foreign and security policy in the Eastern Europe and South Caucasus regions."
     }
   ],
   "name": "Threat actor",

clusters/tool.json

@@ -2571,6 +2571,44 @@
       },
       "description": "QUASARRAT is an open-source RAT available at https://github.com/quasar/QuasarRat . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past.",
       "value": "QUASARRAT"
+    },
+    {
+      "meta": {
+        "refs": [
+          "http://surveillance.rsf.org/en/hacking-team/",
+          "https://wikileaks.org/hackingteam/emails/fileid/581640/267803"
+        ]
+      },
+      "description": "Hacking Team’s \"DaVinci\" Remote Control System is able, the company says, to break encryption and allow law enforcement agencies to monitor encrypted files and emails (even ones encrypted with PGP), Skype and other Voice over IP or chat communication. It allows identification of the target’s location and relationships. It can also remotely activate microphones and cameras on a computer and works worldwide. Hacking Team claims that its software is able to monitor hundreds of thousands of computers at once, all over the country. Trojans are available for Windows, Mac, Linux, iOS, Android, Symbian and Blackberry.",
+      "value": "da Vinci RCS"
+    },
+    {
+      "meta": {
+        "refs": [
+          "https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html",
+          "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html"
+        ]
+      },
+      "description": "LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.",
+      "value": "LATENTBOT"
+    },
+    {
+      "meta": {
+        "refs": [
+          "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html"
+        ]
+      },
+      "description": "Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.",
+      "value": "FINSPY"
+    },
+    {
+      "meta": {
+        "refs": [
+          "https://www.f-secure.com/documents/996508/1030745/callisto-group"
+        ]
+      },
+      "description": "HackingTeam Remote Control System (RCS) Galileo hacking platform",
+      "value": "RCS Galileo"
     }
   ]
 }