MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #459 from Delta-Sierra/target-location-galaxy 

Target location galaxy
pull/464/head
Alexandre Dulaunoy 2019-09-25 14:49:57 +02:00 committed by GitHub
parent 309109eb27 a4b59f647c
commit 884077b25e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 801 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

800
clusters/target-information.json
View File

File diff suppressed because it is too large Load Diff

6
clusters/threat-actor.json
View File

@ -7736,14 +7736,14 @@
},
{
"description": "Early in August 2019, Proofpoint described what appeared to be state-sponsored activity targeting the US utilities sector with malware that we dubbed “Lookback”. Between August 21 and August 29, 2019, several spear phishing emails were identified targeting additional US companies in the utilities sector. The phishing emails originated from what appears to be an actor-controlled domain: globalenergycertification[.]net. This domain, like those used in previous campaigns, impersonated a licensing body related to the utilities sector. In this case, it masqueraded as the legitimate domain for Global Energy Certification (“GEC”). The emails include a GEC examination-themed body and a malicious Microsoft Word attachment that uses macros to install and run LookBack. (Note confusion between Malware, Campaign and ThreatActor)",
"uuid": "5cd95926-0098-435e-892d-9c9f61763ad7",
"value": "LookBack",
"meta": {
"refs": [
"https://www.proofpoint.com/us/threat-insight/post/lookback-forges-ahead-continued-targeting-united-states-utilities-sector-reveals",
"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"
]
}
},
"uuid": "5cd95926-0098-435e-892d-9c9f61763ad7",
"value": "LookBack"
}
],
"version": 135