MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #876 from Mathieu4141/threat-actors/cobalt-mirage 

[threat-actors] More aliases of Iranian apts
pull/877/head
Christophe Vandeplas 2023-10-17 11:29:01 +02:00 committed by GitHub
parent 75d950f1cb e086bee02e
commit e9f884e3f3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
clusters/threat-actor.json
View File

@ -6246,13 +6246,19 @@
"https://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html", "https://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html",
"https://www.cfr.org/cyber-operations/apt-35", "https://www.cfr.org/cyber-operations/apt-35",
"https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/", "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/",
"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/" "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/",
"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/",
"https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/",
"https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us"
], ],
"synonyms": [ "synonyms": [
"Newscaster Team", "Newscaster Team",
"Magic Hound", "Magic Hound",
"G0059", "G0059",
"Phosphorus" "Phosphorus",
"Mint Sandstorm",
"TunnelVision",
"COBALT MIRAGE"
] ]
}, },
"related": [ "related": [
@ -11573,7 +11579,8 @@
"https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/" "https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/"
], ],
"synonyms": [ "synonyms": [
"Nemesis Kitten" "Nemesis Kitten",
"Storm-0270"
] ]
}, },
"related": [ "related": [