MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
2,230 Commits
4 Branches
41 Tags
270 MiB
Commit Graph

2230 Commits (d273a5da7d2c51fb79e5de6ff3911d05add96332)

Author SHA1 Message Date
Delta-Sierra d273a5da7d add TeamTNT ref 2021-02-25 09:52:24 +01:00
Delta-Sierra eb07fab69f add Ragnar Locker and update accordingly 2021-02-23 16:21:07 +01:00
Delta-Sierra 06ae10965b add Covidloc and tycoon ransomware + small updates on some ransomwares 2021-02-22 16:39:47 +01:00
Delta-Sierra 7c1ac58141 add TeamTNT 2021-02-22 16:38:18 +01:00
Delta-Sierra 96bf0d44ea Merge https://github.com/MISP/misp-galaxy 2021-02-09 14:52:58 +01:00
Alexandre Dulaunoy fa05eb04e3
Merge branch 'main' of github.com:MISP/misp-galaxy into main 2021-01-29 16:43:52 +01:00
Alexandre Dulaunoy 38a0d2d32d
chg: [rsit] rsit as galaxy name 2021-01-29 16:43:26 +01:00
Alexandre Dulaunoy 48fddce7d1
Merge pull request #622 from danielplohmann/patch-5 
adding ClearSky alias for Volatile Cedar
 2021-01-29 16:39:03 +01:00
Daniel Plohmann d61e7d2fac
adding ClearSky alias for Volatile Cedar 
adding ClearSky report as source and alias to the VolatileCedar entry. As proof from the report: "We attributed the operation to Lebanese Cedar (also known as Volatile Cedar), mainly based on the code overlaps between the 2015 variants of Explosive RAT and Caterpillar WebShell, to the 2020 variants of these malicious  files."
 2021-01-29 10:39:18 +01:00
Alexandre Dulaunoy 815e5c4fe4
Merge pull request #621 from cudeso/main 
RSIT Galaxy/Cluster
 2021-01-28 12:55:46 +01:00
Koen Van Impe 87b22f363c Move cfr-type-of-incident to meta 2021-01-28 12:25:39 +01:00
Koen Van Impe 23778666ba RSIT Galaxy/Cluster 2021-01-28 10:03:12 +01:00
Alexandre Dulaunoy 06c038e884
Merge pull request #620 from StefanKelm/main 
Update threat-actor.json
 2021-01-26 15:00:34 +01:00
StefanKelm fb35646406
Update threat-actor.json 
Lazarus
 2021-01-26 14:38:37 +01:00
Alexandre Dulaunoy 763d67d2a4
Merge pull request #619 from nyx0/main 
Update tool cluster
 2021-01-20 19:57:43 +01:00
Thomas Dupuy f964514ec5 Add HyperBro in tools 2021-01-20 13:44:28 -05:00
Thomas Dupuy 9df95031a7 Update ZxShell tool. 2021-01-20 13:27:51 -05:00
Alexandre Dulaunoy 402837d033
Merge pull request #618 from StefanKelm/main 
Update threat-actor.json
 2021-01-20 17:49:53 +01:00
StefanKelm a131a7ce98
Update threat-actor.json 
Lazarus
 2021-01-20 17:43:18 +01:00
Alexandre Dulaunoy 3c19c7c1e5
Merge pull request #617 from danielplohmann/patch-4 
merge COVELLITE into Lazarus Group
 2021-01-17 16:05:13 +01:00
Alexandre Dulaunoy dc7de80b98
Merge pull request #616 from r0ny123/patch-2 
removing Starcruft
 2021-01-17 16:04:24 +01:00
Daniel Plohmann ca66fcd93a
merge COVELLITE into Lazarus Group 
I would propose to move COVELLITE as tracked by Dragos as an alias into Lazarus Group and merge the references. 
Dragos' own description states that it refers to the same group as "Lazarus" and "Hidden Cobra" in that infrastructure and tools are the same: https://www.dragos.com/threat-activity-groups/ - the entry in MISP's threat actor library also reflects that.
 2021-01-17 15:07:26 +01:00
Rony 91e87cf82c
Update threat-actor.json 
Don't know how StarCraft
 2021-01-17 12:21:34 +05:30
Alexandre Dulaunoy 830f82f710
Merge pull request #615 from danielplohmann/patch-3 
merging ScarCruft->APT37
 2021-01-16 00:08:26 +01:00
Daniel Plohmann edcc3c0bc1
merging ScarCruft->APT37 
I would like to propose merging entry "ScarCruft" into "APT37". It really just seems like a redundancy, as both its aliases "Operation Daybreak" and "Operation Erebus" are already present for "APT37", along alias "StarCruft", which just seems to be a less popular variation of the name ("StarCruft" 3.2k google hits vs "ScarCruft" 31.5k google hits). The references of the entry can be fully merged as well - they do not overlap so far.
 2021-01-15 18:52:49 +01:00
Delta-Sierra a6f7795952 fix merge 2021-01-12 10:38:33 +01:00
Alexandre Dulaunoy 2b356a9eb0
chg: [threat-actor] UNC2452/DarkHalo added - ref. #614 2021-01-12 07:01:36 +01:00
Alexandre Dulaunoy 184d57f0a2
chg: [ransomware] Babuk Ransomware added 2021-01-05 19:11:28 +01:00
Alexandre Dulaunoy 4454b58743
chg: [ransomware] RegretLocker added 2020-12-30 14:14:09 +01:00
Alexandre Dulaunoy d408b81606
Merge pull request #612 from r0ny123/patch-1 
BISMUTH
 2020-12-14 13:29:23 +01:00
Rony 3240aa819f
Update threat-actor.json 2020-12-14 11:54:41 +05:30
Rony 2ffb77b35b
BISMUTH 2020-12-14 10:41:15 +05:30
Delta-Sierra 31f96513b2 update sidewinder threat actor 2020-12-11 16:09:33 +01:00
Alexandre Dulaunoy ac86ebd5f6
Merge pull request #609 from StefanKelm/master 
Update threat-actor.json
 2020-12-09 22:16:49 +01:00
Alexandre Dulaunoy 691532a2b4
Merge pull request #610 from Delta-Sierra/master 
Add new clusters
 2020-12-09 22:16:07 +01:00
Delta-Sierra ebd31b7376 add BazarBackdoor 2020-12-09 16:42:32 +01:00
Delta-Sierra d3a9cf742a add RansomEXX 2020-12-09 16:32:02 +01:00
Delta-Sierra 3daaa30aed Merge https://github.com/MISP/misp-galaxy 2020-12-07 16:20:36 +01:00
StefanKelm 5dc92995f6
Update threat-actor.json 
DeathStalker, Mabna
 2020-12-04 11:43:06 +01:00
Alexandre Dulaunoy e563ebc6ed
Merge pull request #608 from StefanKelm/master 
Update threat-actor.json
 2020-12-04 10:38:11 +01:00
StefanKelm 4fee985b5e
Update threat-actor.json 
Turla
 2020-12-03 13:05:14 +01:00
Alexandre Dulaunoy 15b27f9497
Merge pull request #607 from StefanKelm/master 
Update threat-actor.json
 2020-12-02 12:23:49 +01:00
StefanKelm 72e085aba9
Update threat-actor.json 
OceanLotus
 2020-12-02 11:44:29 +01:00
Alexandre Dulaunoy 790053b5b0
Merge branch 'main' of github.com:MISP/misp-galaxy into main 2020-11-30 15:50:42 +01:00
Alexandre Dulaunoy b00ea12677
chg: [doc] Travis is dead, GH Action is alive. 2020-11-30 15:50:17 +01:00
Raphaël Vinot 9be4a53f77 fix: reorganize GH actions 2020-11-30 14:33:19 +01:00
Raphaël Vinot 47830ca058 chg: Fix gh actions 2020-11-30 14:22:14 +01:00
Raphaël Vinot 2d885e2a22 chg: Add PR to GH actions 2020-11-30 14:10:12 +01:00
Alexandre Dulaunoy 01ec0a7c28
Merge pull request #606 from StefanKelm/master 
Update threat-actor.json
 2020-11-30 11:56:21 +01:00
StefanKelm 15b5f4c881
Update threat-actor.json 
APT27
 2020-11-30 11:49:23 +01:00