From 858621ebdc839b7963bd34f83a27b72045489f3d Mon Sep 17 00:00:00 2001 From: Daniel Plohmann Date: Thu, 23 Apr 2020 15:47:35 +0200 Subject: [PATCH] Adding Nazar APT as described by JAGS in his OPCDE talk yesterday. --- clusters/threat-actor.json | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index b72f522a..4cb71900 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -8114,7 +8114,20 @@ }, "uuid": "d0b900fa-84b4-11ea-bc55-0242ac130003", "value": "ItaDuke" + }, + { + "description": "This actor was identified by Juan Andres Guerrero-Saade from the SIG37 cluster as published in the ShadowBrokers' 'Lost in Translation' leak. Earliest known sighting potentially dates back to as far as 2008 with a confirmed center of activity around 2010-2013. The actor name is derived from a PDB debug string fragment: 'khzer'. Victimology indicates targeting of Iran, assessed with low confidence based on VT file submission locations. Nazar employs a modular toolkit where a main dropper silently registers multiple DLLs as OLE controls in the Windows registry. Functionality includes keylogging, sound and screen grabbing, as well as traffic capture using the MicroOlap Packet Sniffer library.", + "meta": { + "refs": [ + "https://www.epicturla.com/blog/the-lost-nazar" + ], + "synonyms": [ + "SIG37" + ] + }, + "uuid": "169187c5-9fbe-42df-ae92-6e35846db021", + "value": "Nazar" } ], - "version": 157 + "version": 158 }