Merge pull request #255 from Delta-Sierra/master

Schema update

clusters/ransomware.json

@@ -5387,6 +5387,15 @@
           "crjoker.html"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "10f92054-b028-11e8-a51f-2f82236ac72d",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ],
       "uuid": "2fb307a2-8752-4521-8973-75b68703030d",
       "value": "CryptoJoker"
     },
@@ -10420,7 +10429,16 @@
           "https://www.bleepstatic.com/images/news/columns/week-in-ransomware/2018/august/31/ransom-note.jpg"
         ]
       },
-      "uuid": "10f92054-b028-11e8-a51f-2f82236ac72d"
+      "uuid": "10f92054-b028-11e8-a51f-2f82236ac72d",
+      "related": [
+        {
+          "dest-uuid": "2fb307a2-8752-4521-8973-75b68703030d",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ]
     },
     {
       "value": "CreamPie Ransomware",
@@ -10520,7 +10538,23 @@
         ]
       },
       "uuid": "5d0c28f6-b050-11e8-95a8-7b8e480b9bd2"
+    },
+    {
+      "value": "Sigma Ransomware",
+      "description": "",
+      "meta": {
+        "refs": [
+          "https://www.bleepingcomputer.com/news/security/sigma-ransomware-being-distributed-using-fake-craigslist-malspam/"
+        ],
+        "ransomnotes": [
+          "https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_01.jpg",
+          "https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/ransom-note-html-part_02.jpg",
+          "https://www.bleepstatic.com/images/news/ransomware/s/sigma/craigslist-malspam/payment-portal.jpg",
+          "ReadMe.txt"
+        ]
+      },
+      "uuid": "df025902-b29e-11e8-a2ab-739167419c52"
     }
   ],
-  "version": 31
+  "version": 32
 }

clusters/threat-actor.json

@@ -2597,7 +2597,8 @@
           "Group 77",
           "Labyrinth Chollima",
           "Operation Troy",
-          "Operation GhostSecret"
+          "Operation GhostSecret",
+          "Operation AppleJeus"
         ]
       },
       "related": [
@@ -5700,7 +5701,17 @@
         ]
       },
       "uuid": "f82b352e-a9f8-11e8-8be8-fbcf6eddd58c"
+    },
+    {
+      "value": "PowerPool",
+      "description": "Malware developers have started to use the zero-day exploit for Task Scheduler component in Windows, two days after proof-of-concept code for the vulnerability appeared online.\n\nA security researcher who uses the online name SandboxEscaper on August 27 released the source code for exploiting a security bug in the Advanced Local Procedure Call (ALPC) interface used by Windows Task Scheduler.\n\nMore specifically, the problem is with the SchRpcSetSecurity API function, which fails to properly check user's permissions, allowing write privileges on files in C:\\Windows\\Task.\n\nThe vulnerability affects Windows versions 7 through 10 and can be used by an attacker to escalate their privileges to all-access SYSTEM account level.\n\nA couple of days after the exploit code became available (source and binary), malware researchers at ESET noticed its use in active malicious campaigns from a threat actor they call PowerPool, because of their tendency to use tools mostly written in PowerShell for lateral movement.\n\nThe group appears to have a small number of victims in the following countries: Chile, Germany, India, the Philippines, Poland, Russia, the United Kingdom, the United States, and Ukraine.\n\nThe researchers say that PowerPool developers did not use the binary version of the exploit, deciding instead to make some subtle changes to the source code before recompiling it.",
+      "meta": {
+        "refs": [
+          "https://www.bleepingcomputer.com/news/security/windows-task-scheduler-zero-day-exploited-by-malware/"
+        ]
+      },
+      "uuid": "abd89986-b1b0-11e8-b857-efe290264006"
     }
   ],
-  "version": 55
+  "version": 56
 }

clusters/tool.json

@@ -2515,13 +2515,19 @@
     {
       "description": "Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.",
       "meta": {
-        "derivated_from": [
-          "Shiz"
-        ],
         "refs": [
           "http://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "e6085ce0-af6d-41f7-8bcb-7f2eed246941",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ],
       "uuid": "67d712c8-d254-4820-83fa-9a892b87923b",
       "value": "Shifu"
     },
@@ -2532,6 +2538,15 @@
           "https://securityintelligence.com/tag/shiz-trojan-malware/"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "67d712c8-d254-4820-83fa-9a892b87923b",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ],
       "uuid": "e6085ce0-af6d-41f7-8bcb-7f2eed246941",
       "value": "Shiz"
     },
@@ -5718,5 +5733,5 @@
       "uuid": "69ed8a69-8b33-4195-9b21-a1f4cd76acde"
     }
   ],
-  "version": 85
+  "version": 86
 }

schema_clusters.json

@@ -107,13 +107,6 @@
                   "type": "string"
                 }
               },
-              "derivated_from": {
-                "type": "array",
-                "uniqueItems": true,
-                "items": {
-                  "type": "string"
-                }
-              },
               "status": {
                 "type": "string"
               },