MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
3,162 Commits
6 Branches
47 Tags
73 MiB
Commit Graph

2144 Commits (5b1af60db33997be350b2dc4d052d192fad07f53)

Author SHA1 Message Date
Mathieu Beligon c52ac53765 [threat-actors] Add TA570 2023-02-13 11:54:47 -08:00
Mathieu Beligon 5f274f58c9 [threat-actors] Add Moskalvzapoe 2023-02-13 11:44:59 -08:00
Daniel Plohmann 62256854bc
adding Broadcom name for SaintBear. 2023-02-13 14:05:35 +01:00
Mathieu Beligon 33ff650327 [threat-actors] Add more information about NoName057(16) 2023-02-10 14:14:52 -08:00
Alexandre Dulaunoy 9645b9348b
chg: [tools] TgToxic added 2023-02-09 16:24:45 +01:00
o1mate 239883e2a9 Merging the handguns and shotguns clusters into a single firearm cluster. 2023-02-06 03:28:49 -05:00
Alexandre Dulaunoy 385826063b
chg: [sigma] updated to the latest version 2023-02-05 11:26:16 +01:00
Daniel Plohmann 9710e09e17
new APT29 name used by Recorded Future 
cf. https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf
 2023-02-02 11:46:50 +01:00
Alexandre Dulaunoy 3d6ec1b187
chg: [sigma] updated to the latest version 2023-02-02 11:25:19 +01:00
Jürgen Löhel cf492d9931
chg: [stealer] Adds Album Stealer 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-02-01 17:30:56 -06:00
Alexandre Dulaunoy 033895b052
Merge pull request #812 from jloehel/boldmove 
chg: [backdoor] Adds BOLDMOVE
 2023-01-31 06:24:59 +01:00
Jürgen Löhel c7c2b8441a
chg: [stealer] Removes BluStealer 
The BluStealer is already in the malpedia cluster.

Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-01-30 18:35:28 -06:00
Jürgen Löhel ca635cc3fc
chg: [stealer] Adds DarkCloud and BluStealer 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-01-30 18:29:25 -06:00
Jürgen Löhel 33513241bd
chg: [backdoor] Adds BOLDMOVE 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2023-01-30 16:39:11 -06:00
Alexandre Dulaunoy 150e3152cc
Merge pull request #809 from MISP/dev 
Updated the `region` cluster
 2023-01-27 15:08:16 +01:00
Alexandre Dulaunoy b7543c5012
Merge pull request #789 from Mathieu4141/threat-actors/fix-sectorj04 
[threat-actors] Remove SectorJ04 duplicate
 2023-01-27 15:05:37 +01:00
Mathieu Beligon a452263ace [threat-actors] pr.review: Add SectorJ04 as alias of TA505 2023-01-27 13:32:58 +01:00
o1mate 0b661d4f80 Added two new galaxies : An ammunition galaxy containing a list of known sold ammunitions ordered by brands, and a firearm galaxy containing two clusters (handguns, shotguns) scrapped from a famous vendor and ordered by model name (Format : Model name - SKU). 2023-01-26 08:34:38 -05:00
Delta-Sierra 89bb349184 Merge https://github.com/MISP/misp-galaxy 2023-01-26 11:46:14 +01:00
Delta-Sierra 0bb1f48ad6 fix missing brackets 2023-01-25 14:47:22 +01:00
Christian Studer e87d39e3f4
fix: [region] JQed all the things !! 2023-01-25 09:24:52 +01:00
Delta-Sierra 50ca40e408 add Anubis & Godfather android banking trojans 2023-01-25 09:05:19 +01:00
Christian Studer 51610df907
chg: [region] Updated the `region` Galaxy Cluster 
- Added missing entry (Antarctica)
- Ordered the `subregions` meta field
 2023-01-24 22:53:54 +01:00
ofenomeno cb8d700e62 adding uavs 2023-01-24 19:55:46 +01:00
Alexandre Dulaunoy 2f0dfc7656
chg: [sigma] updated 2023-01-23 10:10:46 +01:00
Alexandre Dulaunoy 4a342354f9
chg: [sigma] updated 2023-01-20 13:58:11 +01:00
Christian Studer 5c21588d7c
add: [country] Manually added the missing relations to some `country` cluster values 
- The previous commit (071ecb8) that added the
  mahority of relations between countries and
  regions were automatically added based on the
  country names specified in the `region` cluster.
  The relations added here are the remaining
  countries that are not litterally defined the
  same way they are in the `region` cluster
 2023-01-16 22:22:42 +01:00
Christian Studer 325f51479b
chg: [country] Clarified the US cluster value 2023-01-16 22:20:30 +01:00
Christian Studer 071ecb8a52
add: [country] Added references between `country` cluster values and the related region they're located in, from the `region` galaxy cluster 2023-01-16 21:35:22 +01:00
Alexandre Dulaunoy 323f9f47a1
chg: [sigma] version must be an integer 2023-01-12 16:45:21 +01:00
Alexandre Dulaunoy fd226d47a2
chg: [sigma] new version of the cluster 2023-01-12 14:10:22 +01:00
Alexandre Dulaunoy c0fdfb0e99
chg: [sigma] updated with latest version + new relationship script 2023-01-12 13:46:31 +01:00
Alexandre Dulaunoy e54366fb87
chg: [threat-actor] added the missing synonyms 2023-01-10 15:55:30 +01:00
Alexandre Dulaunoy 187701bacb
chg: [sigma] regenerated from the test script (also updated the script 
to ensure UUID consistency for the galaxy)
 2023-01-06 15:36:33 +01:00
Alexandre Dulaunoy 9955401791
chg: [sigma] jq all the things 2023-01-06 15:13:35 +01:00
Alexandre Dulaunoy 8539361df5
Merge branch 'main' of https://github.com/jstnk9/misp-galaxy into jstnk9-main 2023-01-06 15:11:27 +01:00
jstnk9 5bcec1d72f
Merge branch 'MISP:main' into main 2023-01-03 11:10:49 +01:00
Jürgen Löhel d4debd619b
chg: [ransomware] Extends the entry for JCrypt 
* Add the reference to MafiaWare666 based on the latest research from
  the Avast Threat Lab: https://decoded.avast.io/threatresearch/decrypted-mafiaware666-ransomware/
* Add more infos from Andrew Ivanovs the great blog post: https://id-ransomware.blogspot.com/2020/12/jcrypt-ransomware.html

Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2022-12-23 01:44:20 -06:00
Delta-Sierra 3f4edb480b add Malteiro 2022-12-16 16:43:50 +01:00
jstnk9 cb19f6bda7 galaxy for sigma rules 2022-12-09 08:48:54 +01:00
Delta-Sierra 5931f51d7a add TAG-53 2022-12-08 11:31:02 +01:00
Delta-Sierra 3ea2d62a83 Version Update 2022-11-28 16:27:54 +01:00
Delta-Sierra 6016b1000c Merge https://github.com/MISP/misp-galaxy 2022-11-28 16:17:08 +01:00
Delta-Sierra 5d83563e0e Fix Duplicate 2022-11-28 16:15:40 +01:00
Delta-Sierra 6c36295318 Update several RAT & Ransomwares 2022-11-28 16:13:38 +01:00
Alexandre Dulaunoy de12f46ba6
chg: [mitre] updated 2022-11-28 12:48:29 +01:00
Alexandre Dulaunoy fda4160bed
chg: [target-information] fix the duplicate 2022-11-24 15:08:16 +01:00
Alexandre Dulaunoy f15e4ed3bc
chg: [target-information] duplicate removal 2022-11-24 15:05:47 +01:00
Alexandre Dulaunoy 1d9a73abdd
chg: [target] fix duplicate synonyms 2022-11-24 15:03:18 +01:00
Christian Studer e3126ef857
fix: [clusters] Fixed some other few `meta` field names 2022-11-24 09:17:28 +01:00
Christian Studer 823124d422
fix; [mitre-ics-assets] Fixed some `refs` meta field names 2022-11-23 20:44:46 +01:00
Christian Studer 493a5bf94e
fix: [target-information] Fixed `synonyms` meta field name 2022-11-23 20:40:35 +01:00
Alexandre Dulaunoy 5c979ae554
fix: [tool] Houdini relationship to something which exist (ok I know it's Houdini) 2022-11-22 15:19:40 +01:00
Alexandre Dulaunoy 0b6034d9be
Merge pull request #800 from Delta-Sierra/main 
Add ransomwares
 2022-11-22 15:11:42 +01:00
Alexandre Dulaunoy 8947d0035b
fix: [sigma rules] until new the PR and tool is done for sigma. The 
galaxy is removed.
 2022-11-22 15:08:17 +01:00
Delta-Sierra 5f0d7f6d68 add VJw0rm description 2022-11-22 14:55:10 +01:00
Delta-Sierra f4abf37b01 fix versions 2022-11-22 12:45:15 +01:00
Delta-Sierra c02b74f999 merge 2022-11-22 12:43:18 +01:00
Delta-Sierra ffc68b9b8f add several ransomwares 2022-11-22 12:40:47 +01:00
Delta-Sierra e316382b8a add qakbot ref 2022-11-22 12:06:03 +01:00
Delta-Sierra 8bf6d73d66 add BazarCall campaign 2022-11-22 09:08:28 +01:00
Delta-Sierra 3c7230e38e add Bazarbackdoor Synonyms 2022-11-22 09:00:04 +01:00
Thomas Dupuy be7450494e Add Evasive Panda Threat Actor 2022-11-18 16:38:11 +00:00
Alexandre Dulaunoy 4844a7021c
chg: [sigma] duplicate value changed 2022-11-18 14:36:02 +01:00
Alexandre Dulaunoy c41b99d8b9
fix: [sigma] remove duplicate references 2022-11-18 14:21:27 +01:00
Alexandre Dulaunoy 59f5fc5f76
Merge branch 'main' of github.com:MISP/misp-galaxy into main 2022-11-18 14:18:29 +01:00
Alexandre Dulaunoy 7d4011a0a2
chg: [sigma] jq all the things 2022-11-18 14:17:52 +01:00
Terrtia e3b6e9d229
fix: [handicap] fix galaxy icon + name + type 2022-11-17 15:16:05 +01:00
Alexandre Dulaunoy 9b8619bbbe
Merge branch 'main' of https://github.com/jstnk9/misp-galaxy into jstnk9-main 2022-11-16 11:07:50 +01:00
Jürgen Löhel f595195cd2
chg: [botnets] Adds KmsdBot 
Signed-off-by: Jürgen Löhel <juergen.loehel@inlyse.com>
 2022-11-15 18:10:39 -06:00
Jstnk9 473f1a13aa galaxy related to sigma rtules 
galaxy related to sigma rtules
 2022-11-15 22:56:18 +01:00
Delta-Sierra 2269f4decd fix tool type 2022-11-15 13:56:53 +01:00
Delta-Sierra 9fc65c0e34 version fix 2022-11-15 13:37:02 +01:00
Delta-Sierra 91d535925f version fix 2022-11-15 13:36:49 +01:00
Delta-Sierra 3837058ab1 merge 2022-11-15 12:54:03 +01:00
Delta-Sierra d020efd276 add raspberry Robin worm & others 2022-11-15 11:57:10 +01:00
Alexandre Dulaunoy b787bbeb23
Merge pull request #792 from nyx0/main 
Add RomCom TA.
 2022-11-05 07:50:20 +01:00
Alexandre Dulaunoy 3b196f8361
Merge pull request #791 from Mathieu4141/threat-actors/add-phosphorus-alias-to-apt-35 
[threat-actors] Add Phosphorus in APT35 aliases
 2022-11-05 07:49:55 +01:00
Thomas Dupuy 9ac53e5d5e Add RomCom TA. 2022-11-04 02:34:10 +00:00
Alexandre Dulaunoy 6c4da5dd55
Merge pull request #790 from Mathieu4141/threat-actors/fix-dust-storm 
[threat-actors] Remove DustStorm alias from APT10
 2022-11-03 11:35:20 +01:00
Alexandre Dulaunoy 52a6fff6a2
Merge pull request #788 from Mathieu4141/threat-actors/fix-cobalt-dickens 
[threat-actors] Remove cobalt dickens duplicate
 2022-11-03 11:27:08 +01:00
Alexandre Dulaunoy 3b4dcd6ad3
Merge pull request #787 from Mathieu4141/threat-actors/fix-subaat-duplicate 
[threat-actors] Remove subaat duplicate
 2022-11-03 11:26:21 +01:00
Mathieu Beligon 8a9dd47f8f [threat-actors] Add Phosphorus in APT35 aliases 2022-11-02 23:49:22 -07:00
Mathieu Beligon 21d4292faf [threat-actors] Remove DustStorm alias from APT10 2022-11-02 23:31:31 -07:00
Mathieu Beligon e61733591f [threat-actors] Remove SectorJ04 duplicate 2022-11-02 20:30:40 -07:00
Mathieu Beligon 9f0869097a [threat-actors] Remove cobalt dickens duplicate 2022-11-02 18:09:42 -07:00
Mathieu Beligon e3e5560e37 [threat-actors] Remove subaat duplicate 2022-11-02 17:57:47 -07:00
Mathieu Beligon 5801bbcfc1 [threat-actors] Remove Skeleton Spider duplicate 2022-11-02 17:38:07 -07:00
Alexandre Dulaunoy 015650c6d7
chg: [mitre-attack] updated to version 12.0 2022-11-01 22:39:33 +01:00
Delta-Sierra 9952366667 add Prynt Stealer & variants 2022-10-14 16:03:45 +02:00
Delta-Sierra 355025eb5b fix metadata in wrong slot 2022-10-04 13:28:42 +02:00
Delta-Sierra e5b3062912 add Volatile Cedar synonym 2022-10-03 16:06:13 +02:00
Thomas Dupuy 4bcf80f01b Add SharPyShell tool. 2022-10-02 22:00:54 +00:00
Alexandre Dulaunoy 409c82f40c
Merge pull request #781 from Mathieu4141/threat-actors/fix-neodymium 
[threat-actors] Fix G0055 (NEODYMIUM) alias
 2022-09-30 06:39:31 +02:00
Alexandre Dulaunoy 588184bacd
Merge pull request #780 from Mathieu4141/threat-actors/fix-svmondr 
[threat-actors] Remove SVCMONDR duplicate
 2022-09-30 06:38:56 +02:00
Alexandre Dulaunoy 800006e6ab
Merge pull request #778 from Mathieu4141/threat-actors/fix-malware-reuser-duplicate 
[threat-actors] Fix Volatile Cedar and Dancing Salome conflicts
 2022-09-30 06:37:15 +02:00
Mathieu Beligon 74c6835d18 [threat-actors] Fix G0055 (NEODYMIUM) alias 2022-09-29 17:16:57 -07:00
Mathieu Beligon a740e35687 [threat-actors] Remove SVCMONDR duplicate 2022-09-29 16:11:19 -07:00
Mathieu Beligon 5994fa4160 [threat-actors] Fix Volatile Cedar and Dancing Salome conflicts 2022-09-29 14:51:38 -07:00
Mathieu Beligon 4f47e6e2d3 [threat-actors] Equation group: separate from Lamberts and add tools 2022-09-29 11:28:54 -07:00
Thomas Dupuy c66d6823a1 Add APT-Q-12 Threat Actor. 2022-09-29 02:30:41 +00:00
Alexandre Dulaunoy c3b65a2d15
chg: [threat-actor] JSON fix 2022-09-27 08:18:13 +02:00
Alexandre Dulaunoy 067e449a41
Merge branch 'main' of https://github.com/nyx0/misp-galaxy into nyx0-main 2022-09-27 08:17:41 +02:00
Christophe Vandeplas e259458d5a chg: [mitre] bump to v11.3 2022-09-27 07:30:13 +02:00
Thomas Dupuy bfd1812cef Add Void Balaur. 2022-09-27 00:11:20 +00:00
Alexandre Dulaunoy eacab6ca27
new: [malpedia] remove duplicate UUIDs objects (coming from Malpedia API) 2022-09-26 10:58:09 +02:00
Alexandre Dulaunoy 7cd322640f
Merge pull request #771 from Delta-Sierra/main 
fetch malpedia
 2022-09-26 10:07:24 +02:00
Delta-Sierra a611230bef fetch malpedia 2022-09-26 09:23:07 +02:00
Mathieu Beligon 22a39f4fdc [threat-actors] Add BITWISE SPIDER 2022-09-20 11:23:33 -07:00
Alexandre Dulaunoy 9b8b51fe53
Merge pull request #769 from Mathieu4141/threat-actors-add/no-name-057-06 
[threat-actors] Add NoName057(16)
 2022-09-17 07:43:42 +02:00
Alexandre Dulaunoy 2f169e4258
Merge pull request #766 from Mathieu4141/threat-actors/fix-ta505 
[threat-actors] Clean TA505 aliases
 2022-09-17 07:43:18 +02:00
Mathieu Beligon 580d2c6931 [threat-actors] Add NoName057(16) 2022-09-16 20:11:06 -06:00
Alexandre Dulaunoy 30cb4e7e60
Merge pull request #768 from Delta-Sierra/main 
New clusters
 2022-09-16 06:40:43 +02:00
Delta-Sierra 8202a7f48f Add PlugX ref 2022-09-15 15:39:47 +02:00
Delta-Sierra 0903300b75 Add Chisel 2022-09-15 13:24:49 +02:00
Delta-Sierra 021fcd2c91 add Lorenz ransomware 2022-09-15 10:29:46 +02:00
Alexandre Dulaunoy 1c8d82cfcc
new: [threat-actor] hezb added 2022-09-14 11:00:33 +02:00
Christophe Vandeplas b011ddee5b fix: [360net] fixes null entries in lists 2022-09-13 22:12:51 +02:00
Christophe Vandeplas c5a5fa7cfa chg: [360net] add 360.net APT list fixes #764 2022-09-13 21:48:16 +02:00
Mathieu Beligon e1f5d3b5d8 [threat-actors] Keep meta from old Xenotime 2022-09-13 11:40:17 -07:00
Mathieu Beligon 4ff0bdfe8e [threat-actors] Clean TA505 aliases 2022-09-13 11:34:02 -07:00
Delta-Sierra e3d88f45c6 add Dark.IoT 2022-09-13 13:35:55 +02:00
Delta-Sierra 6dba3abe13 add hezb 2022-09-13 10:40:00 +02:00
Mathieu Beligon 273c7c9b97 [threat-actors] Remove Xenotime duplicate 2022-09-12 17:10:49 -07:00
Delta-Sierra 705d0d2e72 add BumbleBee backdoor 2022-09-12 10:51:43 +02:00
Delta-Sierra 0440db12e9 add DangerousSavanna campaign 2022-09-07 11:01:23 +02:00
Delta-Sierra 77db2370b1 Add Lockbit synonym 2022-09-07 11:00:41 +02:00
Delta-Sierra 775d3c183b Add Lockbit synonym 2022-09-07 09:26:38 +02:00
Rony aea413cebf chg: [threat-actor] version bump 2022-09-01 10:32:01 +00:00
Rony db913e5ab4 fix: [threat-actor] remove duplicate entries 2022-09-01 09:53:11 +00:00
Rony 6aea5ee05c chg: [threat-actor] add Aoqin Dragon 2022-09-01 09:46:43 +00:00
Rony fb0cf3c7e5 chg: [threat-actor] miscellaneous updates 2022-09-01 09:17:31 +00:00
Daniel Plohmann d18f5bc8b6
mini-fix: adding https protocol to a reference 
in automated processing and display, this may otherwise lead to a malformed local / relative link.
 2022-08-30 17:08:03 +02:00
Alexandre Dulaunoy 5175fb0364
Merge pull request #760 from Delta-Sierra/main 
Add GootLoader & MOUSEISLAND in tool
 2022-08-29 12:02:55 +02:00
Rony e7178a1e08 fix: [threat-actor] remove duplicate entries from APT9 2022-08-27 12:54:32 +00:00
Rony 27300c6381 chg: [threat-actor] add avast blog to APT40 2022-08-27 12:41:31 +00:00
Rony 7f526e230b chg: [threat-actor] add Microsoft and PwC report to actors' references 2022-08-27 12:34:36 +00:00
Rony 6ad9699a38 chg: [threat-actor] add recorded future reference to RedAlpha 2022-08-27 12:10:51 +00:00
Rony 2dc138ae01 chg: [threat-actor] add Adam Kozy's testimony ro APT41 and APT26 2022-08-27 12:08:11 +00:00
Rony 0b140b7097 chg: [threat-actor] miscellaneous updates including merge of some actors and fix the error committed in 9cfcc0d9ac 2022-08-27 11:58:03 +00:00
Alexandre Dulaunoy 8bea9f3b4b
Merge pull request #755 from Mathieu4141/threat-actors/fix-winnti 
[threat-actors] Fix Axiom/Winnti/Suckfly/APT41 conflicts
 2022-08-27 08:25:20 +02:00
Mathieu Béligon 9cfcc0d9ac
Add aliases to APT41 
Co-authored-by: Rony <rony_123@protonmail.ch>
 2022-08-26 14:54:02 -07:00
Mathieu Beligon 6e00329ba6 [threat-actors] Fix aliases 2022-08-26 11:09:29 -07:00
Delta-Sierra 534dacb7fb add GootLoader 2022-08-26 10:12:36 +02:00
Delta-Sierra d5a9365aae add MOUSEISLAND 2022-08-26 09:23:38 +02:00
Mathieu Beligon 9b714dcd76 [threat-actors] Merge Axiom into APT17 2022-08-25 13:49:07 -07:00
Delta-Sierra 5b3c395f10 jq 2022-08-24 14:27:33 +02:00
Delta-Sierra cb422c2190 update Guildma 2022-08-24 14:07:01 +02:00
Yosirion95 cda80e5496 Add synonyms to sector.json 2022-08-21 11:09:50 +02:00
Alexandre Dulaunoy 9efca4c41b
fix: [threat-actor] UUID reused fixed (UUIDs cannot be reused across different cluster) 
Add the missing the relationship for the new UUID
 2022-08-21 09:17:56 +02:00
Rony 5b42a09dc2 add PARINACOTA to threat-actor.json 
MSTIC names digital crime actors based on global volcanoes
 2022-08-20 17:10:15 +00:00
Rony 6fd584fa88 remove APT36/ Transpert Tribe from microsoft-activity-group.json cause we don't know any MSTIC name yet. 2022-08-20 17:06:18 +00:00
Alexandre Dulaunoy 6b137ea12c
Merge pull request #749 from Mathieu4141/threat-actors/fix-naikon-cluster 
[threat actors] Fix threat actors related to Lotus Panda
 2022-08-20 11:46:15 +02:00
Mathieu Beligon 7f82616c10 fix axiom related field 2022-08-19 12:48:40 -07:00
Mathieu Beligon 969f461709 merge into apt41 2022-08-19 12:45:47 -07:00
Christophe Vandeplas 1b69b654a8 chg: [atrm] bump to latest ATRM version 2022-08-19 21:19:23 +02:00
Mathieu Beligon fd9201e9e0 Merge APT22 and suckfly 2022-08-19 12:16:30 -07:00
Mathieu Beligon 768c94671c Fix hellsing ref 2022-08-19 11:34:16 -07:00
Alexandre Dulaunoy a8b234d694
Merge pull request #753 from Mathieu4141/threat-actors/fix-bronze-president 
[threat-actors] Remove duplicated BRONZE PRESIDENT entity
 2022-08-19 06:26:11 +02:00
Mathieu Béligon fcd6faec78
Capitalize override panda alias 
Co-authored-by: Rony <rony_123@protonmail.ch>
 2022-08-18 20:51:03 -07:00
Mathieu Béligon 54f3ef2831
capitalize lotus panda alias 
Co-authored-by: Rony <rony_123@protonmail.ch>
 2022-08-18 20:50:32 -07:00
Mathieu Béligon c9b11553eb
normalize APT30 alias 
Co-authored-by: Rony <rony_123@protonmail.ch>
 2022-08-18 20:32:44 -07:00
Mathieu Beligon c1abedb446 Move Lotus Panda alias to Lotus Blossom 2022-08-18 20:21:31 -07:00
Mathieu Beligon a61ef2a88f [threat-actors] Fix Axiom/Winnti/Suckfly/APT41 conflicts 2022-08-18 17:03:26 -07:00
Mathieu Beligon 84e69ad4be Add DarkCommet as a tool of GoldenRAT 2022-08-18 15:47:04 -07:00
Mathieu Beligon 1acc51a7a6 [threat-actors] Add more data about APT-C-27 2022-08-18 15:44:18 -07:00
Mathieu Beligon ec988c97d0 [threat-actors] Remove duplicated APT-C-27 2022-08-18 15:34:08 -07:00
Mathieu Beligon d9046c8619 [threat-actors] Remove duplicated BRONZE PRESIDENT entity 2022-08-18 15:12:18 -07:00
Mathieu Beligon a046e8094d Merge APT30 and Naikon 2022-08-18 11:36:45 -07:00
Mathieu Beligon 5e4a4c3453 Merge branch 'main' into threat-actors/fix-naikon-cluster 2022-08-18 09:01:36 -07:00
Mathieu Beligon 264e764dfa Remove ATK34 alias 2022-08-18 08:59:04 -07:00
Delta-Sierra 3f036db1e3 add TA558 2022-08-18 15:54:28 +02:00
Mathieu Beligon 71e3e1f3eb Fix ATK aliases 2022-08-17 13:39:43 -07:00
Mathieu Beligon a6242d4732 Merge branch 'main' into threat-actors/fix-naikon-cluster 2022-08-17 13:37:01 -07:00
Mathieu Beligon 0d6399aa2b Add ATK78 alias for Thrip 2022-08-17 12:04:32 -07:00
Mathieu Beligon 53282255ce Branch out Goblin Panda from Hellsing 2022-08-17 11:55:35 -07:00
Mathieu Beligon 3f50cf0175 Create a tool for Esile 2022-08-17 11:19:30 -07:00
Rony f608312577 addresses https://github.com/MISP/misp-galaxy/pull/751#issuecomment-1217680586 2022-08-17 08:52:35 +00:00
Rony ccd10b54f4
remove duplicate reference 2022-08-17 12:49:56 +05:30
Rony 0cec882cc5 merge microcin/sixlittlemonkeys to vicious panda 2022-08-17 07:06:51 +00:00
Alexandre Dulaunoy a373909bb1
Merge pull request #748 from r0ny123/patch-2 
Update threat-actor.json
 2022-08-17 07:44:46 +02:00
Alexandre Dulaunoy 352998a84d
fix: [threat-actor] add missing refs for APT33 including CFR link 2022-08-17 07:40:23 +02:00
Mathieu Beligon d05b29c1af [threat-actors] Remove duplicate APT33 2022-08-16 17:15:30 -07:00
Mathieu Beligon 9c6f106928 [threat actor] Fix aliases related to Lotus Panda 2022-08-16 16:58:35 -07:00
Rony 5b25b574b3 add uac-0010 references from cert-ua 2022-08-16 10:19:53 +00:00
Rony 370045b01d Merge "red october" and "cloud atlas" to inception framework" 2022-08-16 09:30:29 +00:00
Rony 62b168600f
fix duplicates 2022-08-16 12:15:30 +05:30
Rony 490bc6a05c
fix duplicate 2022-08-16 12:10:27 +05:30
Rony bbe84c5985
updates to russian actors 2022-08-16 12:07:59 +05:30
Rony de76aef023
Update threat-actor.json 2022-08-16 10:49:13 +05:30
Rony f4b63d4514
updates to tianwu 2022-08-16 10:30:33 +05:30
Alexandre Dulaunoy 96d31aa8c7
chg: [threat-actor] jq all the things 2022-08-11 17:50:00 +02:00
Thomas Dupuy ed24dcaf19 Add link for SLIME29. 2022-08-11 15:41:01 +00:00
Thomas Dupuy 912050b9b7 Update commit based on feeback. 2022-08-11 15:20:32 +00:00
Thomas Dupuy 6e0df72ef4 Add Threat Actors from BH Asia22 prez. 2022-08-10 18:53:38 +00:00
Christophe Vandeplas 1369756810 chg: [atrm] Add Azure Threat Research Matrix Galaxy and generation script 2022-08-06 21:19:31 +02:00
Daniel Plohmann bdaadea58e
removing a leading double quote in a URL. 2022-08-02 18:17:58 +02:00
Daniel Plohmann bc20a463c8
merging TG2003 / Elephant Beetle into FIN13 
as indicated in the respective resources published by the organizations using these aliases.
 2022-08-02 14:11:43 +02:00
Alexandre Dulaunoy 6427746ad8
Merge pull request #727 from Mathieu4141/threat-actors/merge-cutting-kitten-cleaver 
Fix Cleaver aliases
 2022-07-27 23:17:42 +02:00
Alexandre Dulaunoy 63f5122ad4
Merge pull request #742 from r0ny123/patch-1 
Update threat-actor.json
 2022-07-27 18:56:47 +02:00
Mathieu Beligon 51aacd6b03 Reduce diff with old version 2022-07-26 23:53:22 -07:00
Mathieu Beligon acc6ada575 r0ny123.review: Use Cutting Kitten as main value for ITSecTeam 2022-07-26 23:27:39 -07:00
Mathieu Beligon d815bfa174 Merge remote-tracking branch 'upstream/main' into threat-actors/merge-cutting-kitten-cleaver 2022-07-26 23:22:03 -07:00
Daniel Plohmann 26f6a33695
more aliases from Unit 42 2022-07-26 11:09:33 +02:00
Rony 5a7f3a7207
fix 2022-07-25 17:17:52 +05:30
Rony 8ce0df6eb4
Update threat-actor.json 
Merge aquatic panda & earth lusca
 2022-07-25 17:15:23 +05:30
Alexandre Dulaunoy 6b6398bf2d
fix: [threat-actor] incorrect merge fixed 2022-07-20 18:45:50 +02:00
Alexandre Dulaunoy b4ce9a9453
Merge branch 'main' of https://github.com/r0ny123/misp-galaxy into r0ny123-main 2022-07-20 18:41:27 +02:00
Rony add6b27466 update 2022-07-20 21:39:33 +05:30
Rony 2b54df56f9 update 2022-07-20 21:32:11 +05:30
Rony 2e045d9c8c chg: [fix] resolve conflict 2022-07-20 21:28:15 +05:30
Daniel Plohmann 5825783a85
removed duplicate UUID for Kinsing 
my apologies, looks like I had not rolled a new UUID for one of the entries added...
 2022-07-20 17:07:05 +02:00
Rony 932fcf1871 added Red Nue 2022-07-20 15:07:35 +05:30
Rony 082039b3b0 added CN actors from secureworks threat profile 
https://www.secureworks.com/research/threat-profiles?filter=item-china and fixed some AKAs
 2022-07-20 14:52:58 +05:30
Daniel Plohmann ed32c508b7
added more Unit 42 aliases / groups 2022-07-20 08:38:03 +02:00
Rony 000bfe92d9 add APT9/Red Pegasus & BRONZE EDGEWOOD/Red Hariasa 2022-07-20 10:04:58 +05:30
Rony 2e8a577b0c add PwC naming to CN actors 2022-07-20 09:45:21 +05:30
Rony 3fabd58416 chg: [threat-actor] fixed 2022-07-19 23:36:30 +05:30
Rony 79c84d3768 add Earth Berberoka, Earth Lusca and Earth Wendigo 2022-07-19 22:42:50 +05:30
Daniel Plohmann 082d506b64
adding new Unit 42 names 
First PR: those are the directly mappable names. I will follow up after deconfliction and then with a few new entries.
 2022-07-19 08:45:09 +02:00
Daniel Plohmann 240a757826
Update threat-actor.json 
adding Predatory Sparrow due to recent events.
 2022-07-13 10:02:07 +02:00
Alexandre Dulaunoy cf603e8160
Merge pull request #736 from Delta-Sierra/main 
add Qbot
 2022-07-12 18:41:33 +02:00
Thomas Dupuy 90da0d798f Set country to LB instead of IR based on operational activity. 2022-07-12 16:21:41 +00:00
Delta-Sierra b1c853bf42 update version 2022-07-12 15:51:55 +02:00
Thomas Dupuy 1a8835bcae Remove list from POLONIUM TA. 2022-07-12 13:11:11 +00:00
Thomas Dupuy a86d866534 Add POLONIUM TA. 2022-07-12 12:14:27 +00:00
Delta-Sierra d40017ae50 add Qbot 2022-07-12 14:03:43 +02:00
Delta-Sierra 6c6355f2ba fix typo 2022-07-12 11:31:08 +02:00
Delta-Sierra 300d608770 jq 2022-07-12 10:54:37 +02:00
Delta-Sierra 71c93f5b24 fix caps typo 2022-07-12 10:53:14 +02:00
Delta-Sierra 4ea34fc5a4 Merge https://github.com/Delta-Sierra/misp-galaxy into main 2022-07-12 10:51:59 +02:00
Delta-Sierra 924eda26ca Add EnemyBot +relationships 2022-07-12 10:49:11 +02:00
Deborah Servili ca7d524d9c
Merge branch 'main' into main 2022-07-08 16:27:28 +02:00
Delta-Sierra 29aa7b3f69 add Maui ransomware 2022-07-08 14:49:12 +02:00
Delta-Sierra 56a53433f0 add HelloXD ransomware 2022-07-08 12:05:31 +02:00
Delta-Sierra 279b89f6d9 fix duplicate extension-2 2022-07-06 09:38:02 +02:00
Delta-Sierra 67d5f5c7c0 fix duplicate extension 2022-07-06 09:34:11 +02:00
Delta-Sierra 7e37fa0cdd merge + update medusalocker 2022-07-06 09:28:46 +02:00
Delta-Sierra c2e7ef4fab Update Medusa Locker and others 2022-07-06 08:43:59 +02:00
marjatech 587dc8560b add script to automate malpedia update 2022-07-04 14:24:34 +02:00
Mathieu Beligon 693eed8d78 [threat actor] Break Cleaver aliases into respective entries 2022-07-04 14:05:29 +02:00
marjatech 1212a75cc4 update malpedia 2022-07-04 11:02:02 +02:00
Mathieu Beligon d63c990dad [threat-actors] Separate ITSecTeam from Cleaver 2022-06-30 14:34:05 +02:00
Mathieu Beligon b8d4ffdbde Merge Cutting Kitten and Cleaver 2022-06-29 20:15:12 +02:00
Koen Van Impe 0c9aa68db6 Update surveillance-vendor.json 2022-06-22 13:30:55 +02:00
Koen Van Impe 22c2f7b999 Add RCS Lab S.p.A. to surveillance-vendor 2022-06-22 11:20:52 +02:00
Mathieu Beligon d79c5bd1ab Add ToddyCat Threat actor 2022-06-21 15:12:42 +02:00
Rony c030fcdab6
chg: [threat-actor] added PwC naming for Indian actors 
https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
 2022-06-11 15:46:54 +05:30
Thanat0s 44a99d066a Y en a un peut plus je vous le mets quand meme ? 2022-06-11 04:24:04 -04:00
Thanat0s 57befd7259 jq all the things 2022-06-10 19:12:12 -04:00