MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #86 from Kafeine/master 

Up EK and TDS
pull/87/head
Alexandre Dulaunoy 2017-08-30 10:03:49 +02:00 committed by GitHub
parent 744ebaf3c0 4b94d36d2e
commit 6e3b3590f7
2 changed files with 445 additions and 538 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

973
clusters/exploit-kit.json
View File

@ -1,539 +1,438 @@
{ {
"name": "Exploit-Kit", "values": [{
"type": "exploit-kit", "value": "Astrum",
"source": "MISP Project", "description": "Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography",
"authors": [ "meta": {
"Kafeine", "refs": ["http://malware.dontneedcoffee.com/2014/09/astrum-ek.html",
"Will Metcalf", "http://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/"],
"KahuSecurity" "synonyms": ["Stegano EK"],
], "status": "Active"
"description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years", }
"uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01", },
"version": 5, {
"values": [ "value": "Bingo",
{ "description": "Bingo EK is the name chosen by the defense for a Fiesta-ish EK first spotted in March 2017 and targetting at that times mostly Russia",
"meta": { "meta": {
"status": "Active", "status": "Active"
"synonyms": [ }
"Stegano EK" },
], {
"refs": [ "value": "Terror EK",
"http://malware.dontneedcoffee.com/2014/09/astrum-ek.html", "description": "Terror EK is built on Hunter, Sundown and RIG EK code",
"http://www.welivesecurity.com/2016/12/06/readers-popular-websites-targeted-stealthy-stegano-exploit-kit-hiding-pixels-malicious-ads/" "meta": {
] "refs": ["https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/"],
}, "synonyms": ["Blaze EK",
"description": "Astrum Exploit Kit is a private Exploit Kit used in massive scale malvertising campaigns. It's notable by its use of Steganography", "Neptune EK"],
"value": "Astrum" "status": "Active"
}, }
{ },
"meta": { {
"status": "Active", "value": "DealersChoice",
"synonyms": [ "description": "DealersChoice is a Flash Player Exploit platform triggered by RTF",
"Blaze EK", "meta": {
"Neptune EK" "refs": ["http://researchcenter.paloaltonetworks.com/2016/10/unit42-dealerschoice-sofacys-flash-player-exploit-platform/",
], "http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/"],
"refs": [ "synonyms": ["Sednit RTF EK"],
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/" "status": "Active"
] }
}, },
"description": "Terror EK is built on Hunter, Sundown and RIG EK code", {
"value": "Terror EK" "value": "DNSChanger",
}, "description": "DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser",
{ "meta": {
"meta": { "refs": ["http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html",
"status": "Active", "https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices"],
"synonyms": [ "synonyms": ["RouterEK"],
"Sednit RTF EK" "status": "Active"
], }
"refs": [ },
"http://researchcenter.paloaltonetworks.com/2016/10/unit42-dealerschoice-sofacys-flash-player-exploit-platform/", {
"http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/" "value": "Disdain",
] "description": "Disdain EK has been introduced on underground forum on 2017-08-07. The panel is stolen from Sundown, the pattern are Terror alike and the obfuscation reminds Nebula",
}, "meta": {
"description": "DealersChoice is a Flash Player Exploit platform triggered by RTF", "refs": ["http://blog.trendmicro.com/trendlabs-security-intelligence/new-disdain-exploit-kit-detected-wild/"],
"value": "DealersChoice" "status": "Active"
}, }
{ },
"meta": { {
"status": "Active", "value": "Kaixin",
"synonyms": [ "description": "Kaixin is an exploit kit mainly seen behind compromised website in Asia",
"RouterEK" "meta": {
], "refs": ["http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/",
"refs": [ "http://www.kahusecurity.com/2012/new-chinese-exploit-pack/"],
"http://malware.dontneedcoffee.com/2015/05/an-exploit-kit-dedicated-to-csrf.html", "synonyms": ["CK vip"],
"https://www.proofpoint.com/us/threat-insight/post/home-routers-under-attack-malvertising-windows-android-devices" "status": "Active"
] }
}, },
"description": "DNSChanger Exploit Kit is an exploit kit targeting Routers via the browser", {
"value": "DNSChanger" "value": "Magnitude",
}, "description": "Magnitude EK",
{ "meta": {
"meta": { "refs": ["http://malware.dontneedcoffee.com/2013/10/Magnitude.html",
"status": "Active", "https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Peek-Into-the-Lion-s-Den-%E2%80%93-The-Magnitude--aka-PopAds--Exploit-Kit/",
"synonyms": [ "http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html",
"3ROS Exploit Kit" "https://community.rsa.com/community/products/netwitness/blog/2017/02/09/magnitude-exploit-kit-under-the-hood"],
], "synonyms": ["Popads EK",
"refs": [ "TopExp"],
"https://www.proofpoint.com/us/threat-insight/post/Hunter-Exploit-Kit-Targets-Brazilian-Banking-Customers" "status": "Active"
] }
}, },
"description": "Hunter EK is an evolution of 3Ros EK", {
"value": "Hunter" "value": "MWI",
}, "description": "Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks",
{ "meta": {
"meta": { "refs": ["https://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html",
"status": "Active", "https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-microsoft-word-intruder-revealed.pdf"],
"synonyms": [ "status": "Active"
"CK vip" }
], },
"refs": [ {
"http://www.kahusecurity.com/2013/deobfuscating-the-ck-exploit-kit/", "value": "RIG",
"http://www.kahusecurity.com/2012/new-chinese-exploit-pack/" "description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.",
] "meta": {
}, "refs": ["http://www.kahusecurity.com/2014/rig-exploit-pack/",
"description": "Kaixin is an exploit kit mainly seen behind compromised website in Asia", "https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the-Architecture-of-RIG-Exploit-Kit-3-0/",
"value": "Kaixin" "https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%E2%80%93-Diving-Deeper-into-the-Infrastructure/",
}, "http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"],
{ "synonyms": ["RIG 3",
"meta": { "RIG-v",
"status": "Active", "RIG 4",
"synonyms": [ "Meadgive"],
"Popads EK", "status": "Active"
"TopExp" }
], },
"refs": [ {
"http://malware.dontneedcoffee.com/2013/10/Magnitude.html", "value": "Sednit EK",
"https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Peek-Into-the-Lion-s-Den-%E2%80%93-The-Magnitude--aka-PopAds--Exploit-Kit/", "description": "Sednit EK is the exploit kit used by APT28",
"http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html", "meta": {
"https://community.rsa.com/community/products/netwitness/blog/2017/02/09/magnitude-exploit-kit-under-the-hood" "refs": ["http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/",
] "http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/"],
}, "status": "Active"
"description": "Magnitude EK", }
"value": "Magnitude" },
}, {
{ "value": "Sundown-P",
"meta": { "description": "Sundown-P/Sundown-Pirate is a rip of Sundown seen used in a private way (One group using it only) - First spotted at the end of June 2017, branded as CaptainBlack in August 2017",
"status": "Active", "meta": {
"refs": [ "refs": ["http://blog.trendmicro.com/trendlabs-security-intelligence/promediads-malvertising-sundown-pirate-exploit-kit/"],
"https://www.fireeye.com/blog/threat-research/2015/04/a_new_word_document.html", "synonyms": ["Sundown-Pirate",
"https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-microsoft-word-intruder-revealed.pdf" "CaptainBlack"],
] "status": "Active"
}, }
"description": "Microsoft Word Intruder is an exploit kit focused on Word and embedded flash exploits. The author wants to avoid their customer to use it in mass spam campaign, so it's most often connected to semi-targeted attacks", },
"value": "MWI" {
}, "value": "Bizarro Sundown",
{ "description": "Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features",
"meta": { "meta": {
"status": "Active", "refs": ["http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/",
"synonyms": [ "https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/"],
"Job314", "synonyms": ["Sundown-b"],
"Neutrino Rebooted", "status": "Retired"
"Neutrino-v" }
], },
"refs": [ {
"http://malware.dontneedcoffee.com/2013/03/hello-neutrino-just-one-more-exploit-kit.html", "value": "Hunter",
"http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html" "description": "Hunter EK is an evolution of 3Ros EK",
] "meta": {
}, "refs": ["https://www.proofpoint.com/us/threat-insight/post/Hunter-Exploit-Kit-Targets-Brazilian-Banking-Customers"],
"description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.", "synonyms": ["3ROS Exploit Kit"],
"value": "Neutrino" "status": "Retired - Last seen 2017-02-06"
}, }
{ },
"meta": { {
"status": "Active", "value": "GreenFlash Sundown",
"synonyms": [ "description": "GreenFlash Sundown is a variation of Bizarro Sundown without landing",
"RIG 3", "meta": {
"RIG-v", "refs": ["http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/"],
"RIG 4", "synonyms": ["Sundown-GF"],
"Meadgive" "status": "Active"
], }
"refs": [ },
"http://www.kahusecurity.com/2014/rig-exploit-pack/", {
"https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Reloaded---Examining-the-Architecture-of-RIG-Exploit-Kit-3-0/", "value": "Angler",
"https://www.trustwave.com/Resources/SpiderLabs-Blog/RIG-Exploit-Kit-%E2%80%93-Diving-Deeper-into-the-Infrastructure/", "description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC",
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html" "meta": {
] "refs": ["https://blogs.sophos.com/2015/07/21/a-closer-look-at-the-angler-exploit-kit/",
}, "http://malware.dontneedcoffee.com/2015/12/xxx-is-angler-ek.html",
"description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.", "http://malware.dontneedcoffee.com/2016/06/is-it-end-of-angler.html"],
"value": "RIG" "synonyms": ["XXX",
}, "AEK",
{ "Axpergle"],
"meta": { "status": "Retired - Last seen: 2016-06-07"
"status": "Active", }
"refs": [ },
"http://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/", {
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/" "value": "Archie",
] "description": "Archie EK",
}, "meta": {
"description": "Sednit EK is the exploit kit used by APT28", "refs": ["https://www.alienvault.com/blogs/labs-research/archie-just-another-exploit-kit"],
"value": "Sednit EK" "status": "Retired"
}, }
{ },
"meta": { {
"status": "Retired", "value": "BlackHole",
"synonyms": [ "description": "The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)",
"Sundown-b" "meta": {
], "refs": ["https://www.trustwave.com/Resources/SpiderLabs-Blog/Blackhole-Exploit-Kit-v2/",
"refs": [ "https://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/"],
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/", "synonyms": ["BHEK"],
"https://blog.malwarebytes.com/cybercrime/exploits/2016/10/yet-another-sundown-ek-variant/" "status": "Retired - Last seen: 2013-10-07"
] }
}, },
"description": "Bizarro Sundown appears to be a fork of Sundown with added anti-analysis features", {
"value": "Bizarro Sundown" "value": "Bleeding Life",
}, "description": "Bleeding Life is an exploit kit that became open source with its version 2",
{ "meta": {
"meta": { "refs": ["http://www.kahusecurity.com/2011/flash-used-in-idol-malvertisement/",
"status": "Active", "http://thehackernews.com/2011/10/bleeding-life-2-exploit-pack-released.html"],
"synonyms": [ "synonyms": ["BL",
"Sundown-GF" "BL2"],
], "status": "Retired"
"refs": [ }
"http://blog.trendmicro.com/trendlabs-security-intelligence/new-bizarro-sundown-exploit-kit-spreads-locky/" },
] {
}, "value": "Cool",
"description": "GreenFlash Sundown is a variation of Bizarro Sundown without landing", "description": "The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013",
"value": "GreenFlash Sundown" "meta": {
}, "refs": ["http://malware.dontneedcoffee.com/2012/10/newcoolek.html",
{ "http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html",
"meta": { "http://blog.trendmicro.com/trendlabs-security-intelligence/styx-exploit-pack-how-it-works/"],
"status": "Retired - Last seen: 2016-06-07", "synonyms": ["CEK",
"synonyms": [ "Styxy Cool"],
"XXX", "status": "Retired - Last seen: 2013-10-07"
"AEK", }
"Axpergle" },
], {
"refs": [ "value": "Fiesta",
"https://blogs.sophos.com/2015/07/21/a-closer-look-at-the-angler-exploit-kit/", "description": "Fiesta Exploit Kit",
"http://malware.dontneedcoffee.com/2015/12/xxx-is-angler-ek.html", "meta": {
"http://malware.dontneedcoffee.com/2016/06/is-it-end-of-angler.html" "refs": ["http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-exploit-kit-an",
] "http://www.kahusecurity.com/2011/neosploit-is-back/"],
}, "synonyms": ["NeoSploit",
"description": "The Angler Exploit Kit has been the most popular and evolved exploit kit from 2014 to middle of 2016. There was several variation. The historical \"indexm\" variant was used to spread Lurk. A vip version used notabily to spread Poweliks, the \"standard\" commercial version, and a declinaison tied to load selling (mostly bankers) that can be associated to EmpirePPC", "Fiexp"],
"value": "Angler" "status": "Retired - Last Seen: beginning of 2015-07"
}, }
{ },
"meta": { {
"status": "Retired", "value": "Empire",
"refs": [ "description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
"https://www.alienvault.com/blogs/labs-research/archie-just-another-exploit-kit" "meta": {
] "refs": ["http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"],
}, "synonyms": ["RIG-E"],
"description": "Archie EK", "status": "Retired - Last seen: 2016-12-29"
"value": "Archie" }
}, },
{ {
"meta": { "value": "FlashPack",
"status": "Retired - Last seen: 2013-10-07", "description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version",
"synonyms": [ "meta": {
"BHEK" "refs": ["http://malware.dontneedcoffee.com/2012/11/meet-critxpack-previously-vintage-pack.html",
], "http://malware.dontneedcoffee.com/2013/04/meet-safe-pack-v20-again.html"],
"refs": [ "synonyms": ["FlashEK",
"https://www.trustwave.com/Resources/SpiderLabs-Blog/Blackhole-Exploit-Kit-v2/", "SafePack",
"https://nakedsecurity.sophos.com/exploring-the-blackhole-exploit-kit/" "CritXPack",
] "Vintage Pack"],
}, "status": "Retired - Last seen: middle of 2015-04"
"description": "The BlackHole Exploit Kit has been the most popular exploit kit from 2011 to 2013. Its activity stopped with Paunch's arrest (all activity since then is anecdotal and based on an old leak)", }
"value": "BlackHole" },
}, {
{ "value": "GrandSoft",
"meta": { "description": "GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013",
"status": "Retired", "meta": {
"synonyms": [ "refs": ["http://malware.dontneedcoffee.com/2013/09/FinallyGrandSoft.html",
"BL", "http://malware.dontneedcoffee.com/2012/10/neosploit-now-showing-bh-ek-20-like.html",
"BL2" "https://nakedsecurity.sophos.com/2012/08/24/sophos-sucks-malware/"],
], "synonyms": ["StampEK",
"refs": [ "SofosFO"],
"http://www.kahusecurity.com/2011/flash-used-in-idol-malvertisement/", "status": "Retired - Last seen: 2014-03"
"http://thehackernews.com/2011/10/bleeding-life-2-exploit-pack-released.html" }
] },
}, {
"description": "Bleeding Life is an exploit kit that became open source with its version 2", "value": "HanJuan",
"value": "Bleeding Life" "description": "Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015",
}, "meta": {
{ "refs": ["http://www.malwaresigs.com/2013/10/14/unknown-ek/",
"meta": { "https://blog.malwarebytes.com/threat-analysis/2014/08/shining-some-light-on-the-unknown-exploit-kit/",
"status": "Retired - Last seen: 2013-10-07", "http://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-the-exploit-kit-in-cve-2015-0313-attack",
"synonyms": [ "https://twitter.com/kafeine/status/562575744501428226"],
"CEK", "status": "Retired - Last seen: 2015-07"
"Styxy Cool" }
], },
"refs": [ {
"http://malware.dontneedcoffee.com/2012/10/newcoolek.html", "value": "Himan",
"http://malware.dontneedcoffee.com/2013/07/a-styxy-cool-ek.html", "description": "Himan Exploit Kit",
"http://blog.trendmicro.com/trendlabs-security-intelligence/styx-exploit-pack-how-it-works/" "meta": {
] "refs": ["http://malware.dontneedcoffee.com/2013/10/HiMan.html"],
}, "synonyms": ["High Load"],
"description": "The Cool Exploit Kit was a kind of BlackHole VIP in 2012/2013", "status": "Retired - Last seen: 2014-04"
"value": "Cool" }
}, },
{ {
"meta": { "value": "Impact",
"status": "Retired - Last Seen: beginning of 2015-07", "description": "Impact EK",
"synonyms": [ "meta": {
"NeoSploit", "refs": ["http://malware.dontneedcoffee.com/2012/12/inside-impact-exploit-kit-back-on-track.html"],
"Fiexp" "status": "Retired"
], }
"refs": [ },
"http://blog.0x3a.com/post/110052845124/an-in-depth-analysis-of-the-fiesta-exploit-kit-an", {
"http://www.kahusecurity.com/2011/neosploit-is-back/" "value": "Infinity",
] "description": "Infinity is an evolution of Redkit",
}, "meta": {
"description": "Fiesta Exploit Kit", "refs": ["http://blog.talosintel.com/2013/11/im-calling-this-goon-exploit-kit-for-now.html",
"value": "Fiesta" "http://www.kahusecurity.com/2014/the-resurrection-of-redkit/"],
}, "synonyms": ["Redkit v2.0",
{ "Goon"],
"meta": { "status": "Retired - Last seen: 2014-07"
"status": "Retired - Last seen: 2016-12-29", }
"synonyms": [ },
"RIG-E" {
], "value": "Lightsout",
"refs": [ "description": "Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex",
"http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html" "meta": {
] "refs": ["http://blog.talosintel.com/2014/03/hello-new-exploit-kit.html",
}, "http://blog.talosintel.com/2014/05/continued-analysis-of-lightsout-exploit.html",
"description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors", "http://malwageddon.blogspot.fr/2013/09/unknown-ek-by-way-how-much-is-fish.html"],
"value": "Empire" "status": "Unknown - Last seen: 2014-03"
}, }
{ },
"meta": { {
"status": "Retired - Last seen: middle of 2015-04", "value": "Nebula",
"synonyms": [ "description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
"FlashEK", "meta": {
"SafePack", "refs": ["http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"],
"CritXPack", "status": "Retired - Last seen 2017-03-09"
"Vintage Pack" }
], },
"refs": [ {
"http://malware.dontneedcoffee.com/2012/11/meet-critxpack-previously-vintage-pack.html", "value": "Neutrino",
"http://malware.dontneedcoffee.com/2013/04/meet-safe-pack-v20-again.html" "description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from march 2014 till november 2014.",
] "meta": {
}, "refs": ["http://malware.dontneedcoffee.com/2013/03/hello-neutrino-just-one-more-exploit-kit.html",
"description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version", "http://malware.dontneedcoffee.com/2014/11/neutrino-come-back.html"],
"value": "FlashPack" "synonyms": ["Job314",
}, "Neutrino Rebooted",
{ "Neutrino-v"],
"meta": { "status": "Retired - Last seen 2017-04-10"
"status": "Retired - Last seen: 2014-03", }
"synonyms": [ },
"StampEK", {
"SofosFO" "value": "Niteris",
], "description": "Niteris was used mainly to target Russian.",
"refs": [ "meta": {
"http://malware.dontneedcoffee.com/2013/09/FinallyGrandSoft.html", "refs": ["http://malware.dontneedcoffee.com/2014/06/cottoncastle.html",
"http://malware.dontneedcoffee.com/2012/10/neosploit-now-showing-bh-ek-20-like.html", "http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html"],
"https://nakedsecurity.sophos.com/2012/08/24/sophos-sucks-malware/" "synonyms": ["CottonCastle"],
] "status": "Unknown - Last seen: 2015-11"
}, }
"description": "GrandSoft Exploit Kit was a quite common exploit kit used in 2012/2013", },
"value": "GrandSoft" {
}, "value": "Nuclear",
{ "description": "The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack",
"meta": { "meta": {
"status": "Retired - Last seen: 2015-07", "refs": ["http://blog.checkpoint.com/2016/05/17/inside-nuclears-core-unraveling-a-ransomware-as-a-service-infrastructure/"],
"refs": [ "synonyms": ["NEK",
"http://www.malwaresigs.com/2013/10/14/unknown-ek/", "Nuclear Pack",
"https://blog.malwarebytes.com/threat-analysis/2014/08/shining-some-light-on-the-unknown-exploit-kit/", "Spartan",
"http://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-the-exploit-kit-in-cve-2015-0313-attack", "Neclu"],
"https://twitter.com/kafeine/status/562575744501428226" "status": "Retired - Last seen: 2015-04-30"
] }
}, },
"description": "Hanjuan EK was a one actor fed variation of Angler EK used in evolved malvertising chain targeting USA. It has been using a 0day (CVE-2015-0313) from beginning of December 2014 till beginning of February 2015", {
"value": "HanJuan" "value": "Phoenix",
}, "description": "Phoenix Exploit Kit",
{ "meta": {
"meta": { "refs": ["http://malwareint.blogspot.fr/2010/09/phoenix-exploits-kit-v21-inside.html",
"status": "Retired - Last seen: 2014-04", "http://blog.trendmicro.com/trendlabs-security-intelligence/now-exploiting-phoenix-exploit-kit-version-2-5/"],
"synonyms": [ "synonyms": ["PEK"],
"High Load" "status": "Retired"
], }
"refs": [ },
"http://malware.dontneedcoffee.com/2013/10/HiMan.html" {
] "value": "Private Exploit Pack",
}, "description": "Private Exploit Pack",
"description": "Himan Exploit Kit", "meta": {
"value": "Himan" "refs": ["http://malware.dontneedcoffee.com/2013/07/pep-new-bep.html",
}, "http://malwageddon.blogspot.fr/2013/07/unknown-ek-well-hey-hey-i-wanna-be.html"],
{ "synonyms": ["PEP"],
"meta": { "status": "Retired"
"status": "Retired", }
"refs": [ },
"http://malware.dontneedcoffee.com/2012/12/inside-impact-exploit-kit-back-on-track.html" {
] "value": "Redkit",
}, "description": "Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic",
"description": "Impact EK", "meta": {
"value": "Impact" "refs": ["https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Wild-Exploit-Kit-Appears----Meet-RedKit/",
}, "http://malware.dontneedcoffee.com/2012/05/inside-redkit.html",
{ "https://nakedsecurity.sophos.com/2013/05/09/redkit-exploit-kit-part-2/"],
"meta": { "status": "Retired"
"status": "Retired - Last seen: 2014-07", }
"synonyms": [ },
"Redkit v2.0", {
"Goon" "value": "Sakura",
], "description": "Description Here",
"refs": [ "meta": {
"http://blog.talosintel.com/2013/11/im-calling-this-goon-exploit-kit-for-now.html", "refs": ["http://www.xylibox.com/2012/01/sakura-exploit-pack-10.html"],
"http://www.kahusecurity.com/2014/the-resurrection-of-redkit/" "status": "Retired - Last seen: 2013-09"
] }
}, },
"description": "Infinity is an evolution of Redkit", {
"value": "Infinity" "value": "Sundown",
}, "description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
{ "meta": {
"meta": { "refs": ["http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
"status": "Unknown - Last seen: 2014-03", "https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"],
"refs": [ "synonyms": ["Beps",
"http://blog.talosintel.com/2014/03/hello-new-exploit-kit.html", "Xer",
"http://blog.talosintel.com/2014/05/continued-analysis-of-lightsout-exploit.html", "Beta"],
"http://malwageddon.blogspot.fr/2013/09/unknown-ek-by-way-how-much-is-fish.html" "status": "Retired - Last seen 2017-03-08",
] "colour": "#C03701"
}, }
"description": "Lightsout Exploit Kit has been used in Watering Hole attack performed by the APT Group havex", },
"value": "Lightsout" {
}, "value": "Sweet-Orange",
{ "description": "Sweet Orange",
"meta": { "meta": {
"status": "Retired - Last seen 2017-03-09", "refs": ["http://malware.dontneedcoffee.com/2012/12/juice-sweet-orange-2012-12.html"],
"refs": [ "synonyms": ["SWO",
"http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html" "Anogre"],
] "status": "Retired - Last seen: 2015-04-05"
}, }
"description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS", },
"value": "Nebula" {
}, "value": "Styx",
{ "description": "Styx Exploit Kit",
"meta": { "meta": {
"status": "Unknown - Last seen: 2015-11", "refs": ["http://malware.dontneedcoffee.com/2012/12/crossing-styx-styx-sploit-pack-20-cve.html",
"synonyms": [ "https://krebsonsecurity.com/2013/07/styx-exploit-pack-domo-arigato-pc-roboto/",
"CottonCastle" "http://malware.dontneedcoffee.com/2013/05/inside-styx-2013-05.html"],
], "status": "Retired - Last seen: 2014-06"
"refs": [ }
"http://malware.dontneedcoffee.com/2014/06/cottoncastle.html", },
"http://malware.dontneedcoffee.com/2015/05/another-look-at-niteris-post.html" {
] "value": "WhiteHole",
}, "description": "WhiteHole Exploit Kit appeared in January 2013 in the tail of the CVE-2013-0422",
"description": "Niteris was used mainly to target Russian.", "meta": {
"value": "Niteris" "refs": ["http://malware.dontneedcoffee.com/2013/02/briefly-wave-whitehole-exploit-kit-hello.html"],
}, "status": "Retired - Last seen: 2013-12"
{ }
"meta": { },
"status": "Retired - Last seen: 2015-04-30", {
"synonyms": [ "value": "Unknown",
"NEK", "description": "Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.",
"Nuclear Pack", "meta": {
"Spartan", "refs": ["https://twitter.com/kafeine",
"Neclu" "https://twitter.com/node5",
], "https://twitter.com/kahusecurity"]
"refs": [ }
"http://blog.checkpoint.com/2016/05/17/inside-nuclears-core-unraveling-a-ransomware-as-a-service-infrastructure/" }],
] "version": 5,
}, "uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01",
"description": "The Nuclear Pack appeared in 2009 and has been one of the longer living one. Spartan EK was a landing less variation of Nuclear Pack", "description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years",
"value": "Nuclear" "authors": ["Kafeine",
}, "Will Metcalf",
{ "KahuSecurity"],
"meta": { "source": "MISP Project",
"status": "Retired", "type": "exploit-kit",
"synonyms": [ "name": "Exploit-Kit"
"PEK"
],
"refs": [
"http://malwareint.blogspot.fr/2010/09/phoenix-exploits-kit-v21-inside.html",
"http://blog.trendmicro.com/trendlabs-security-intelligence/now-exploiting-phoenix-exploit-kit-version-2-5/"
]
},
"description": "Phoenix Exploit Kit",
"value": "Phoenix"
},
{
"meta": {
"status": "Retired",
"synonyms": [
"PEP"
],
"refs": [
"http://malware.dontneedcoffee.com/2013/07/pep-new-bep.html",
"http://malwageddon.blogspot.fr/2013/07/unknown-ek-well-hey-hey-i-wanna-be.html"
]
},
"description": "Private Exploit Pack",
"value": "Private Exploit Pack"
},
{
"meta": {
"status": "Retired",
"refs": [
"https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Wild-Exploit-Kit-Appears----Meet-RedKit/",
"http://malware.dontneedcoffee.com/2012/05/inside-redkit.html",
"https://nakedsecurity.sophos.com/2013/05/09/redkit-exploit-kit-part-2/"
]
},
"description": "Redkit has been a major exploit kit in 2012. One of its specific features was to allow its access against a share of a percentage of the customer's traffic",
"value": "Redkit"
},
{
"meta": {
"status": "Retired - Last seen: 2013-09",
"refs": [
"http://www.xylibox.com/2012/01/sakura-exploit-pack-10.html"
]
},
"description": "Description Here",
"value": "Sakura"
},
{
"meta": {
"colour": "#C03701",
"status": "Retired - Last seen 2017-03-08",
"synonyms": [
"Beps",
"Xer",
"Beta"
],
"refs": [
"http://malware.dontneedcoffee.com/2015/06/fast-look-at-sundown-ek.html",
"https://www.virusbulletin.com/virusbulletin/2015/06/beta-exploit-pack-one-more-piece-crimeware-infection-road"
]
},
"description": "Sundown Exploit Kit is mainly built out of stolen code from other exploit kits",
"value": "Sundown"
},
{
"meta": {
"status": "Retired - Last seen: 2015-04-05",
"synonyms": [
"SWO",
"Anogre"
],
"refs": [
"http://malware.dontneedcoffee.com/2012/12/juice-sweet-orange-2012-12.html"
]
},
"description": "Sweet Orange",
"value": "Sweet-Orange"
},
{
"meta": {
"status": "Retired - Last seen: 2014-06",
"refs": [
"http://malware.dontneedcoffee.com/2012/12/crossing-styx-styx-sploit-pack-20-cve.html",
"https://krebsonsecurity.com/2013/07/styx-exploit-pack-domo-arigato-pc-roboto/",
"http://malware.dontneedcoffee.com/2013/05/inside-styx-2013-05.html"
]
},
"description": "Styx Exploit Kit",
"value": "Styx"
},
{
"meta": {
"refs": [
"https://twitter.com/kafeine",
"https://twitter.com/node5",
"https://twitter.com/kahusecurity"
]
},
"description": "Unknown Exploit Kit. This is a place holder for any undocumented Exploit Kit. If you use this tag, we will be more than happy to give the associated EK a deep look.",
"value": "Unknown"
}
]
} }

8
clusters/tds.json
View File

@ -11,6 +11,14 @@
"Commercial" "Commercial"
] ]
} }
}, {
"value": "ShadowTDS",
"description": "ShadowTDS is advertised underground since 2016-02. It's in fact more like a Social Engineering kit focused on Android and embedding a TDS",
"meta": {
"type": [
"Underground"
]
}
}, },
{ {
"value": "Sutra", "value": "Sutra",