MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

more clusters

pull/239/head
Deborah Servili 2018-08-03 15:58:54 +02:00
parent e7d2541929
commit a9a71ef84c
No known key found for this signature in database
GPG Key ID: 7E3A832850D4D7D1
3 changed files with 30 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
clusters/rat.json
View File

@ -2,7 +2,7 @@
"uuid": "312f8714-45cb-11e7-b898-135207cdceb9", "uuid": "312f8714-45cb-11e7-b898-135207cdceb9",
"description": "remote administration tool or remote access tool (RAT), also called sometimes remote access trojan, is a piece of software or programming that allows a remote \"operator\" to control a system as if they have physical access to that system.", "description": "remote administration tool or remote access tool (RAT), also called sometimes remote access trojan, is a piece of software or programming that allows a remote \"operator\" to control a system as if they have physical access to that system.",
"source": "MISP Project", "source": "MISP Project",
"version": 11, "version": 12,
"values": [ "values": [
{ {
"meta": { "meta": {
@ -548,7 +548,8 @@
"meta": { "meta": {
"date": "2014", "date": "2014",
"refs": [ "refs": [
"https://github.com/quasar/QuasarRAT" "https://github.com/quasar/QuasarRAT",
"https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/"
] ]
}, },
"uuid": "6efa425c-3731-44fd-9224-2a62df061a2d", "uuid": "6efa425c-3731-44fd-9224-2a62df061a2d",

27
clusters/threat-actor.json
View File

@ -3748,8 +3748,29 @@
"https://research.checkpoint.com/apt-attack-middle-east-big-bang/", "https://research.checkpoint.com/apt-attack-middle-east-big-bang/",
"https://blog.talosintelligence.com/2017/06/palestine-delphi.html" "https://blog.talosintelligence.com/2017/06/palestine-delphi.html"
] ]
} },
} "uuid": "a6fdd972-971a-11e8-bf58-9b08a198e9a3"
},
{
"value": "Subaat",
"description": "In mid-July, Palo Alto Networks Unit 42 identified a small targeted phishing campaign aimed at a government organization. While tracking the activities of this campaign, we identified a repository of additional malware, including a web server that was used to host the payloads used for both this attack as well as others.",
"meta": {
"refs": [
"https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/"
]
},
"uuid": "a7bc4ef2-971a-11e8-9bf0-13aa7d6d8651"
},
{
"value": "Gorgon Group",
"description": "Unit 42 researchers have been tracking Subaat, an attacker, since 2017. Recently Subaat drew our attention due to renewed targeted attack activity. Part of monitoring Subaat included realizing the actor was possibly part of a larger crew of individuals responsible for carrying out targeted attacks against worldwide governmental organizations. Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec, in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking, which we are calling Gorgon Group.",
"meta": {
"refs": [
"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"
]
},
"uuid": "a80b042a-971a-11e8-8df0-1f40df1bf6e9"
},
], ],
"name": "Threat actor", "name": "Threat actor",
"type": "threat-actor", "type": "threat-actor",
@ -3763,5 +3784,5 @@
], ],
"description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.", "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.",
"uuid": "7cdff317-a673-4474-84ec-4f1754947823", "uuid": "7cdff317-a673-4474-84ec-4f1754947823",
"version": 46 "version": 47
} }

5
clusters/tool.json
View File

@ -2,7 +2,7 @@
"uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f", "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
"description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.", "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
"source": "MISP Project", "source": "MISP Project",
"version": 78, "version": 79,
"values": [ "values": [
{ {
"meta": { "meta": {
@ -2847,7 +2847,8 @@
{ {
"meta": { "meta": {
"refs": [ "refs": [
"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html" "https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html",
"https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/"
] ]
}, },
"description": "QUASARRAT is an open-source RAT available at https://github.com/quasar/QuasarRat . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past.", "description": "QUASARRAT is an open-source RAT available at https://github.com/quasar/QuasarRat . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past.",