From b3701b6b34f2bbbb32b065cf1407709cdde95ae9 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 3 Aug 2018 10:26:52 +0200 Subject: [PATCH] chg: [threat-actor] The Gordon Group added ref: https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/ --- clusters/threat-actor.json | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index f173001..b0d856a 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -3759,6 +3759,7 @@ }, { "value": "The Big Bang", + "uuid": "475df014-556a-41db-ad6a-ff509dd202a1", "description": "While it is not clear exactly what the attacker is looking for, what is clear is that once he finds it, a second stage of the attack awaits, fetching additional modules and/or malware from the Command and Control server. This then is a surveillance attack in progress and has been dubbed ‘Big Bang’ due to the attacker’s fondness for the ‘Big Bang Theory’ TV show, after which some of the malware’s modules are named.", "meta": { "refs": [ @@ -3766,6 +3767,16 @@ "https://blog.talosintelligence.com/2017/06/palestine-delphi.html" ] } + }, + { + "value": "The Gorgon Group", + "description": "Unit 42 researchers have been tracking Subaat, an attacker, since 2017. Recently Subaat drew our attention due to renewed targeted attack activity. Part of monitoring Subaat included realizing the actor was possibly part of a larger crew of individuals responsible for carrying out targeted attacks against worldwide governmental organizations. Technical analysis on some of the attacks as well as attribution links with Pakistan actors have been already depicted by 360 and Tuisec, in which they found interesting connections to a larger group of attackers Unit 42 researchers have been tracking, which we are calling Gorgon Group.", + "uuid": "e47c2c4d-706b-4098-92a2-b93e7103e131", + "meta": { + "refs": [ + "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/" + ] + } } ], "name": "Threat actor", @@ -3780,5 +3791,5 @@ ], "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.", "uuid": "7cdff317-a673-4474-84ec-4f1754947823", - "version": 48 + "version": 49 }