From 9f33bdc13c313d5dbc677cf697db7c6b7fac54b4 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Wed, 17 Apr 2024 10:09:09 -0700 Subject: [PATCH] [threat-actors] Add CoralRaider --- clusters/threat-actor.json | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 8fb89f8..9dc3366 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -15598,6 +15598,17 @@ }, "uuid": "a5aa9b72-2bfb-427c-97fc-6ec04357233b", "value": "BlackJack" + }, + { + "description": "CoralRaider is a financially motivated threat actor of Vietnamese origin, targeting victims in Asian and Southeast Asian countries since at least 2023. They use the RotBot loader family and XClient stealer to steal victim information, with hardcoded Vietnamese words in their payloads. CoralRaider operates from Hanoi, Vietnam, and uses a Telegram bot as a C2 channel for their malicious campaigns. Their activities include system reconnaissance, data exfiltration, and targeting victims in multiple countries in the region.", + "meta": { + "country": "VN", + "refs": [ + "https://blog.talosintelligence.com/coralraider-targets-socialmedia-accounts/" + ] + }, + "uuid": "20927a3f-d011-4e22-8268-0938d6816a13", + "value": "CoralRaider" } ], "version": 305