Merge https://github.com/MISP/misp-galaxy

README.md

@@ -495,7 +495,7 @@ Category: *actor* - source: *MISP Project* - total: *38* elements
 
 [Ransomware](https://www.misp-galaxy.org/ransomware) - Ransomware galaxy based on different sources and maintained by the MISP Project.
 
-Category: *tool* - source: *Various* - total: *1804* elements
+Category: *tool* - source: *Various* - total: *1805* elements
 
 [[HTML](https://www.misp-galaxy.org/ransomware)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/ransomware.json)]
 

clusters/ransomware.json

@@ -28560,7 +28560,8 @@
       "description": "",
       "meta": {
         "links": [
-          "http://weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onion"
+          "http://weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onion",
+          "http://c7jpc6h2ccrdwmhofuij7kz6sr2fg2ndtbvvqy4fse23cf7m2e5hvqid.onion"
         ],
         "refs": [
           "https://www.ransomlook.io/group/black suit"
@@ -29691,6 +29692,18 @@
       },
       "uuid": "2a1e103b-da5f-56d6-a0c8-5daff4c4fd87",
       "value": "orca"
+    },
+    {
+      "meta": {
+        "links": [
+          "http://hackerosyolorz77y7vwj57zobwdeuzydhctz3kuuzr52ylzayvxuqyd.onion"
+        ],
+        "refs": [
+          "https://www.ransomlook.io/group/osyolorz collective"
+        ]
+      },
+      "uuid": "99ddf1b6-7d75-58f6-b340-47545fec5e55",
+      "value": "osyolorz collective"
     }
   ],
   "version": 134

clusters/threat-actor.json

@@ -12795,6 +12795,15 @@
           "https://www.sentinelone.com/labs/cyber-soft-power-chinas-continental-takeover/"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ],
       "uuid": "1f7f4a51-c4a8-4365-ade3-83b222e7cb67",
       "value": "Earth Estries"
     },
@@ -15242,10 +15251,29 @@
       "meta": {
         "country": "CN",
         "refs": [
-          "https://www.mandiant.com/resources/blog/unc4841-post-barracuda-zero-day-remediation",
-          "https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/"
+          "https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/",
+          "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf",
+          "https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/",
+          "https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf",
+          "https://cloud.google.com/blog/topics/threat-intelligence/unc4841-post-barracuda-zero-day-remediation",
+          "https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/",
+          "https://www.wsj.com/politics/national-security/china-cyberattack-internet-providers-260bd835"
+        ],
+        "synonyms": [
+          "FamousSparrow",
+          "UNC2286",
+          "Salt Typhoon"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "1f7f4a51-c4a8-4365-ade3-83b222e7cb67",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ],
       "uuid": "3c3ca8f3-c6ab-4c5d-9bd0-be6677d6cdeb",
       "value": "GhostEmperor"
     },