[threat-actors] Add Tstark

clusters/threat-actor.json

@@ -17336,6 +17336,17 @@
       },
       "uuid": "ca448608-83fa-467d-8637-1cf004fd8e8a",
       "value": "FrostyNeighbor"
+    },
+    {
+      "description": "TStark is a threat actor identified by X-Ops, associated with a cluster of devices that executed the bookmark buffer overflow exploit targeting CVE-2020-15069 (T1203). The actor exhibited odd telemetry behavior indicative of intermittent VPN usage, switching between IP addresses geolocated to Hong Kong and Chengdu. Analysis revealed malware samples for Mac OS X and iOS, as well as IFRAME injection code exploiting a WebAssembly vulnerability (T1189). Additionally, TStark was linked to the development of libsophos.so and the deployment of malicious payloads across their devices.",
+      "meta": {
+        "country": "CN",
+        "refs": [
+          "https://news.sophos.com/en-us/2024/10/31/pacific-rim-timeline/"
+        ]
+      },
+      "uuid": "7c1af433-bde1-4c35-85d3-e951b5020187",
+      "value": "Tstark"
     }
   ],
   "version": 320