From ed26f4d246e84bb790682014f9a2867f666214a9 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 15 Feb 2024 03:42:28 -0800
Subject: [PATCH 1/2] [threat-actors] Add TA2725

---
 clusters/threat-actor.json | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index ec1afc5..ca2f74f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -14981,6 +14981,16 @@
       },
       "uuid": "a1527821-fe84-44ec-ad29-8d3040463bc9",
       "value": "Operation Emmental"
+    },
+    {
+      "description": "TA2725 is a threat actor that has been tracked since March 2022. They primarily target organizations in Brazil and Mexico using Brazilian banking malware and phishing techniques. Recently, they have expanded their operations to also target victims in Spain and Mexico simultaneously. TA2725 typically uses GoDaddy virtual hosting for their URL redirector and hosts malicious files on legitimate cloud hosting providers like Amazon AWS, Google Cloud, or Microsoft Azure. They have been known to spoof legitimate companies, such as ÉSECÈ Group, to deceive their victims.",
+      "meta": {
+        "refs": [
+          "https://www.proofpoint.com/us/blog/threat-insight/copacabana-barcelona-cross-continental-threat-brazilian-banking-malware"
+        ]
+      },
+      "uuid": "1697dace-fe21-452c-acee-bef62fc5e386",
+      "value": "TA2725"
     }
   ],
   "version": 300

From f4d69382cf2d836ef965f1f625fb02e0abac81da Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 15 Feb 2024 03:42:29 -0800
Subject: [PATCH 2/2] [threat-actors] Add Blackatom

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index ca2f74f..836beb2 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -14991,6 +14991,17 @@
       },
       "uuid": "1697dace-fe21-452c-acee-bef62fc5e386",
       "value": "TA2725"
+    },
+    {
+      "description": "Recent campaigns suggest Hamas-linked actors may be advancing their\nTTPs to include intricate social engineering lures specially crafted to\nappeal to a niche group of high value targets. In September 2023, a Palestine-based group likely linked to Hamas targeted Israeli software engineers\nusing an elaborate social engineering ruse that ultimately installed malware\nand stole cookies. The attackers, which Google’s Threat Analysis Group (TAG) tracks as BLACKATOM, posed as employees of legitimate companies\nand reached out via LinkedIn to invite targets to apply for software development freelance opportunities. Targets included software engineers in\nthe Israeli military, as well as Israel’s aerospace and defense industry",
+      "meta": {
+        "country": "PS",
+        "refs": [
+          "https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf"
+        ]
+      },
+      "uuid": "264687b8-82f4-43b5-b7bb-dc3e0b9246bc",
+      "value": "Blackatom"
     }
   ],
   "version": 300