MISP
/
misp-galaxy
mirror of https://github.com/MISP/misp-galaxy
2
0
Fork 0
Code Issues Releases Wiki Activity
2,145 Commits
6 Branches
46 Tags
42 MiB
Commit Graph

483 Commits (e5ea22a3b0c15639478981850daaaf3f5599e60e)

Author SHA1 Message Date
Benoit Sevens 8f8c69134e
Update threat-actor.json 
Add LuckyMouse link
 2018-11-12 13:12:14 +01:00
Deborah Servili 14444e4321
add several tools and refs 2018-11-08 10:39:32 +01:00
Daniel Plohmann 1f6b606f75
added APT38 as (FireEye) alias for Lazarus 
cross-references in https://content.fireeye.com/apt/rpt-apt38 suggest the link to Lazarus.
 2018-11-07 17:19:50 +01:00
Alexandre Dulaunoy 2465235817
Merge pull request #293 from Delta-Sierra/master 
add Operation EvilTraffic
 2018-10-30 21:02:59 +01:00
Deborah Servili e6b1eec329
add Chalubo botnet (+ jqallthethings) 2018-10-30 14:39:13 +01:00
Deborah Servili 41942d0daf
add Operation EvilTraffic 2018-10-30 13:28:46 +01:00
Deborah Servili 74ff4b957a
add Operation EvilTraffic 2018-10-30 13:28:27 +01:00
Nils Kuhnert bc0bf1ca9f
Corrected DarkHotel threat actor entry 2018-10-29 09:03:30 +01:00
Deborah Servili af6020077e
add August Stealer 2018-10-23 15:25:37 +02:00
Deborah Servili bd68ee280e Merge branch 'master' of https://github.com/MISP/misp-galaxy 2018-10-22 11:09:37 +02:00
Deborah Servili 4564c5eb37
add DarkPulsar and affiliates + update some refs 2018-10-22 10:14:30 +02:00
Christophe Vandeplas 9dddc4427c jq 2018-10-19 10:23:09 +02:00
Christophe Vandeplas ddccac58c8 chg: categorization of galaxies 
This allows relationships to be created.
 2018-10-19 10:18:14 +02:00
Christophe Vandeplas 2b24efb14a fix: add missing relations from commit b857be9cab 2018-10-17 19:15:57 +02:00
Christophe Vandeplas 873bc873b4 Merge remote-tracking branch 'MISP/master' 2018-10-17 18:28:44 +02:00
Christophe Vandeplas 1e90cac717 fix: intrusion is an actor and not a tool 2018-10-17 18:17:33 +02:00
Deborah Servili c8cbb609a2
add GreyEnergy 2018-10-17 16:05:51 +02:00
Deborah Servili 2ea560f9a7
add refs & synonyms 2018-10-15 12:02:21 +02:00
Deborah Servili 11a27df82d
add roaming mantis group 2018-10-12 15:50:52 +02:00
Deborah Servili b3109f6aea Merge branch 'master' of https://github.com/MISP/misp-galaxy 2018-10-12 13:55:01 +02:00
Christophe Vandeplas f26a4f2806 fix: minor newline difference after jq_all_the 2018-10-12 12:31:29 +02:00
Christophe Vandeplas f14d616e22 chg: magical mapping with malpedia 2018-10-12 11:00:00 +02:00
Christophe Vandeplas 2fbd8ce485 jq sort keys 
Allows automation to edit the files
 2018-10-12 10:35:31 +02:00
Deborah Servili 4c367737ac
add magecart ref 2018-10-10 14:52:16 +02:00
Deborah Servili 5bcf34a953
update regarding https://twitter.com/adulau/status/1047764090410737664 2018-10-04 10:28:22 +02:00
Deborah Servili c78416eee1
update synonyms & attributions 2018-10-04 10:09:34 +02:00
Deborah Servili 3dfe8a5a34 add FASTCash 2018-10-03 15:09:14 +02:00
Deborah Servili 403f162451
add ref for magecart 2018-10-01 11:54:07 +02:00
Deborah Servili 35582f7ed5
new threat actors & tools 2018-10-01 11:52:40 +02:00
Alexandre Dulaunoy 49fe210812
Merge pull request #270 from Delta-Sierra/master 
new clusters, relations and information
 2018-09-28 12:57:13 +02:00
Deborah Servili fbf21487cf
new clusters and informtion 2018-09-28 11:08:21 +02:00
Nex 014aa325b7 Added missing country values 2018-09-26 23:05:46 +02:00
Deborah Servili f7e10cb38d
add references 2018-09-24 14:58:21 +02:00
Deborah Servili 2bc8e1e719
add Cobalt Dickensthreat actor 2018-09-24 11:51:09 +02:00
Deborah Servili 5a1734f170
update version 2018-09-21 11:16:36 +02:00
Deborah Servili 3c7e367cbf
fix field mistake 2018-09-21 11:14:19 +02:00
Deborah Servili 1cee9d71e0
update Lazarus group cluster 2018-09-20 15:38:32 +02:00
Deborah Servili 6d43d52731
new unnamedthreat actor 2018-09-20 13:24:11 +02:00
Deborah Servili d0864a6531
new threat actors 2018-09-20 12:10:20 +02:00
Deborah Servili 0a724bee3d
merge 2018-09-19 16:01:46 +02:00
Deborah Servili 058f778e61
add references 2018-09-19 09:04:04 +02:00
Alexandre Dulaunoy 79146b9d10
fix: array in synonyms (MISP accepts it but not the schema ;-) 2018-09-19 07:35:35 +02:00
Alexandre Dulaunoy 6105522453
chg: [threat-actor] Iron Group added 
ref: https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/
 2018-09-19 07:08:16 +02:00
Alexandre Dulaunoy 8238bd5eb1
Merge pull request #263 from botherder/bahamut 
Added Bahamut to threat actors list
 2018-09-19 06:46:26 +02:00
Nex f0383758fc Added Bahamut to threat actors list 2018-09-18 11:27:32 +02:00
Alexandre Dulaunoy fe60e58f5b
Merge pull request #262 from botherder/mythic-leopard 
Added additional name to C-Major
 2018-09-18 11:25:58 +02:00
Nex 1e502a494e Added additional name to C-Major 2018-09-18 11:18:42 +02:00
Nex ee7f609397 Removed duplicates 2018-09-18 11:16:00 +02:00
Alexandre Dulaunoy 88c9d8d9f6
Merge pull request #259 from botherder/country-sync 
Synced country codes with suspected state sponsor
 2018-09-17 18:18:00 +02:00
Nex be0dd94c90 Synced country codes with suspected state sponsor 2018-09-17 16:26:14 +02:00
Nex c2ea505459 Merged Transparent Tribe in C-Major 2018-09-17 16:11:18 +02:00
Deborah Servili a73424139f
fix versions 2018-09-12 14:26:44 +02:00
Deborah Servili f107563cad
add ref for operation Applejeus 2018-09-12 09:34:16 +02:00
Deborah Servili c92dc15937
add Operation AppleJeus 2018-09-10 14:13:09 +02:00
Deborah Servili 40d5cca20f
clusters 2018-09-07 16:03:40 +02:00
Deborah Servili f14dd27315
add cfr data 2018-08-27 15:29:16 +02:00
Deborah Servili 9efca2fd79 more clusters 
Signed-off-by: Deborah Servili <deborah.servili@gmail.com>
 2018-08-24 16:11:16 +02:00
Deborah Servili c943d1c9d1
add APT28/STRONTIUM refs 2018-08-22 09:59:40 +02:00
Alexandre Dulaunoy cd76f19f52
chg: [threat-actor] APT-C-35 actor added 
ref: https://ti.360.net/blog/articles/latest-activity-of-apt-c-35/
 2018-08-15 20:25:57 +02:00
Christophe Vandeplas 88162aa44e chg: [mapping] Generated automatic mapping between clusters 2018-08-14 09:35:22 +02:00
Christophe Vandeplas 5478f0aa45 no change: dump files with sort_keys=True 
This is needed to keep better track of the changes when other tools load and save the json files.
 2018-08-13 17:06:29 +02:00
Christophe Vandeplas 021107e597 fix: [threat-actor] added missing uuids 2018-08-13 17:00:40 +02:00
Alexandre Dulaunoy 6620b5575a
fix: [threat-actor] related is an array of JSON objects 2018-08-09 07:53:42 +02:00
Alexandre Dulaunoy 1429b60555
chg: [threat-actor] jq document 2018-08-08 16:38:39 +02:00
Deborah Servili ebc7287e14
update schema 2018-08-08 16:12:29 +02:00
Deborah Servili 33a300b773
tags is an array 2018-08-08 15:59:44 +02:00
Deborah Servili b857be9cab
relationship system - v2 2018-08-08 15:51:22 +02:00
Deborah Servili 050a864be0
update some clusters and try to add a relationship system 2018-08-08 14:20:38 +02:00
Deborah Servili 84adb50f0f
add RedAlpha campaigns 2018-08-07 13:55:05 +02:00
Deborah Servili b7de06ffcc
delete forgotten conflict marker 2018-08-06 08:49:44 +02:00
Deborah Servili 010df0a2b6
resolve merge conflict 2018-08-06 08:48:21 +02:00
Deborah Servili def23775e5
resolve merge conflict 2018-08-06 08:45:03 +02:00
Nils Kuhnert ab49b58b02
Added DarkHydrus 2018-08-06 08:33:34 +02:00
Nils Kuhnert 4654f51889
Two small typos 2018-08-05 15:09:38 +02:00
Deborah Servili e5b185deee
Merge branch 'master' into master 2018-08-03 16:11:16 +02:00
Deborah Servili 35aa8ba34e
delete duplicate gorgon group 2018-08-03 16:08:43 +02:00
Deborah Servili a9a71ef84c
more clusters 2018-08-03 15:58:54 +02:00
Alexandre Dulaunoy b3701b6b34
chg: [threat-actor] The Gordon Group added 
ref: https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/
 2018-08-03 10:26:52 +02:00
Alexandre Dulaunoy 3da005a3f3
fix: jq all the things(tm) 2018-08-02 15:15:47 +02:00
Alexandre Dulaunoy 1fdf47d509
fix: [threat-actor] synonyms are always arraus 2018-08-02 15:13:18 +02:00
Alexandre Dulaunoy ece56dff38
chg: [threat-actor] leafminer - RASPITE added 2018-08-02 15:08:39 +02:00
Alexandre Dulaunoy 43fa95df7a
chg: [threat-actor] new reference to CARBON SPIDER/Carbanak 2018-08-02 10:03:18 +02:00
Deborah Servili 381f7e4a19 Add CFR.org metadata into the galaxy - part 2 2018-07-25 09:08:16 +02:00
Deborah Servili 28456545be Merge https://github.com/MISP/misp-galaxy 2018-07-16 09:16:13 +02:00
Alexandre Dulaunoy 98db303047
chg: [threat-actor] The Big Bang campaign/group added 2018-07-10 08:49:00 +02:00
Deborah Servili cae0f7e1ad merging attempt 2018-06-29 16:39:34 +02:00
Deborah Servili 8c51ef98b3 add cfr related informations -still in progress- 2018-06-29 16:36:58 +02:00
Deborah Servili fb6b01cc95
Merge branch 'master' into master 2018-06-27 09:39:28 +02:00
Deborah Servili b1aac6b35b cfr update -in progress + add clusters associated to RANCOR 2018-06-27 09:37:43 +02:00
Alexandre Dulaunoy 1bd0fb34d7
Merge pull request #233 from Delta-Sierra/master 
Add CFR.org metadata into the galaxy - Test
 2018-06-26 14:26:18 +02:00
Deborah Servili 6f9e639981 add cfr prefix for cfr data - test 2018-06-26 10:07:14 +02:00
Deborah Servili 1cd6bddf0c Add CFR.org metadata into the galaxy - Test 2018-06-26 09:40:13 +02:00
Nils Kuhnert ed26cfb042
Updated APT1 report link 2018-06-22 13:49:05 +02:00
Andras Iklody 8e014674af
Fixed typo 2018-06-20 09:45:16 +02:00
Deborah Servili dcda058944 update verion 2018-06-20 09:36:36 +02:00
Deborah Servili e18fdf42da add Thrip as threat actor 2018-06-20 09:30:15 +02:00
Deborah Servili d8c83cf2d6 add cluster in threat actor 2018-06-18 10:54:58 +02:00
Alexandre Dulaunoy c08c6af936
chg: Stalker Panda description added 2018-05-29 21:47:04 +02:00
Raphaël Vinot 96f3bf1cb8 fix: Duplicate ELECTRUM entry 
Fix #212
 2018-05-19 17:57:51 -04:00
Alexandre Dulaunoy 3a7c4e3c57
Merge pull request #211 from eCrimeLabs/master 
Added links in relation to Threat-actor info from Dragos
 2018-05-15 16:17:56 +02:00
Dennis Rand 1ab4e4f4cf Added data related to Dragos Adverseries 2018-05-15 12:06:48 +00:00
Deborah Servili 5e0bd260d6 update some clusters 2018-05-09 16:12:02 +02:00
Deborah Servili 58e3e5f5d6 add ZooPark campaign 2018-05-04 10:16:01 +02:00
Alexandre Dulaunoy 6b1d7d2201
add: threat actors from Dragos Inc. (based on https://dragos.com/adversaries.html) 2018-05-03 21:22:09 +02:00
Deborah Servili 55504f93d6 add HOGFISH as APT10 synonym 2018-05-03 11:10:21 +02:00
Deborah Servili 11f0963468 add Orangeworm, Kwampirs, Iron ransomware and Ton ransomware 2018-04-24 10:20:11 +02:00
Deborah Servili c785ee6384 add some ransomwares & threat actors 2018-04-16 09:24:11 +02:00
Deborah Servili 8596ff3e10 update threat actor galaxy based on https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf 2018-04-09 11:52:12 +02:00
Daniel Plohmann (jupiter) 83fd4a9af9 added leviathan 2018-03-17 11:57:10 +01:00
Deborah Servili 5fa09c0962 update version 2018-03-12 11:54:29 +01:00
Deborah Servili 73eb11fedd update Mirage Threat actor 2018-03-12 10:44:57 +01:00
Deborah Servili 3f8b44bbe3 jq 2018-03-01 15:02:48 +01:00
Deborah Servili 227fa8b44f Merge https://github.com/MISP/misp-galaxy 2018-03-01 15:01:49 +01:00
Deborah Servili b3574f880a jq ftw 2018-02-28 16:16:28 +01:00
Deborah Servili d88a4a44dc add uuid to every cluster 2018-02-28 15:37:37 +01:00
Alexandre Dulaunoy 22bf4f951f
fix #161 2018-02-27 19:32:07 +01:00
Deborah Servili 42596842a8 add synonym and ref for Emissary Panda (Iron Tiger APT) 2018-02-20 10:37:47 +01:00
Alexandre Dulaunoy 1831752530
add ref to Nexus Zeta 2018-01-25 15:43:33 +01:00
Alexandre Dulaunoy 193b474ad2
add: Nexus Zeta is no stranger when it comes to implementing SOAP 
relatedrelated exploit ;-)
 2018-01-25 15:41:47 +01:00
Daniel Plohmann 6de7c0176d adding dark caracal 2018-01-25 12:54:50 +01:00
Deborah Servili 8240934eb5 fix forgotten value Microcin 2018-01-11 16:01:19 +01:00
Deborah Servili 130ad39d4c add macOS malwares 2018-01-11 15:19:18 +01:00
Deborah Servili db8ae5fbfe update OilRig threat actor 2017-12-18 09:26:15 +01:00
Deborah Servili 5cac510818 update threat actor galaxy 2017-12-13 14:57:38 +01:00
steffenenders 96749fd350
Fixed mixed up description/value for MuddyWater 2017-11-19 19:23:10 +01:00
Deborah Servili e2dbd5a9a3 add MuddyWater + Update HIDDEN COBRA and update its tools 2017-11-17 15:41:44 +01:00
Deborah Servili 09bab156c7 update version number 2017-11-09 12:30:32 +01:00
Deborah Servili 3369270bdb add Sowbug group 2017-11-08 15:05:37 +01:00
Fredrik Borg 72d8bfc28a fix-iso-code-3 2017-11-07 14:15:40 +01:00
Fredrik Borg afc4972e25 fix iso codes 2017-11-07 14:04:04 +01:00
Fredrik Borg 53a6a8d26f remove duplicate references 2017-11-07 13:34:44 +01:00
Siri Bromander bf0d1d27ca Updated with data from APT Groups and Operations 2017-11-07 11:07:23 +01:00
Fredrik Borg 26192bf39a Bump version number 2017-11-01 18:14:20 +01:00
Fredrik Borg 51f86d5382 Use standard (2 digits) ISO codes for all countries 2017-11-01 12:38:21 +01:00
Daniel Plohmann 02710714bd add APT33 as identified by FireEye 2017-09-29 11:43:38 +02:00
Daniel Plohmann 355a230182 added FIN7 as alias for anunak 2017-08-01 13:29:57 +02:00
Daniel Plohmann b4e49823dd merged barium into axiom (only one redundant reference given) 2017-08-01 13:13:56 +02:00
Raphaël Vinot 282c3a8101 Merge pull request #74 from Delta-Sierra/master 
adding clusters based on MISP data
 2017-07-26 11:41:00 +02:00
Deborah Servili 7e59f14dca update Spring Dragon threat actor 2017-07-26 09:21:36 +02:00
Raphaël Vinot 8598210895 Remove empty string. 2017-07-25 18:02:11 +02:00
Alexandre Dulaunoy a295d40589 Cobalt gang added 2017-07-08 10:16:11 +02:00
Alexandre Dulaunoy c0786dfb22 El Machete added 2017-06-26 11:44:46 +02:00
Alexandre Dulaunoy dd2a51037a jq all ;-) 2017-06-20 20:34:04 +02:00
Jaime f92b9cb710 Added FIN8 actor 2017-06-20 11:28:32 -07:00
David André 3dfbb7e1d0 Added Symantec alias for sofacy 2017-06-16 11:22:17 +02:00
danielplohmann 5724f19873 Merge branch 'master' into hidden-cobra-lazarus 2017-06-15 14:13:50 +02:00
Daniel Plohmann (jupiter) f7963c9a8c added Hidden Cobra as alias for Lazarus Group 2017-06-15 14:09:29 +02:00
Daniel Plohmann ff4f428bc1 added ELECTRUM to threat-actor.json (afaik not confirmed as an alias atm) 2017-06-13 13:25:16 +02:00
Daniel Plohmann 9924a8875c added PLATINUM to threat-actor.json (afaik not confirmed as an alias atm) 2017-06-13 13:21:10 +02:00
Alexandre Dulaunoy 91663c4793 Merge pull request #58 from danielplohmann/wildneutron 
added WildNeutron (Morph, Butterfly, Sphinx Moth)
 2017-06-06 10:02:56 +02:00
Deborah Servili aa34718b13 edit threat actor - should fix #59 and #60 2017-06-06 08:40:29 +02:00
Daniel Plohmann (jupiter) 068dc40a78 added WildNeutron (Morph, Butterfly, Sphinx Moth) 2017-06-05 19:13:27 +02:00
David André 83833f257c Added synonyms for APT10 and one for APT1 2017-06-02 10:26:45 +02:00
Alexandre Dulaunoy fab863933e SilverTerrier added 2017-05-30 08:40:26 +02:00
Alexandre Dulaunoy 5da5df6384 APT32 added 2017-05-15 09:18:28 +02:00
Déborah Servili 531595c944 ##comma## 2017-04-14 14:52:23 +02:00
Déborah Servili 54512eb840 Add some tools/threat actor 2017-04-14 14:48:39 +02:00
Alexandre Dulaunoy bbf6716c73 Longhorn (CIA) added 2017-04-10 20:22:57 +02:00
nyx0 78cdb10aae Add new Sednit name according to https://www.secureworks.com/research/iron-twilight-supports-active-measures 2017-03-31 09:28:50 -04:00
chrisdoman dbf989c742 Added descriptions and reference to threat-actor json 2017-03-22 12:52:05 +00:00
Raphaël Vinot e1b5701351 JQ all the things 2017-03-16 17:31:43 +01:00
Raphaël Vinot 0d8d265319 Fix typo. 2017-03-16 17:27:17 +01:00
CERT-Bund 4112a041f7 Added groups, joined groups, added synonyms (see extended description) 
Added: HammerPanda, Barium, Infy, Sima, Groundbait
Joined: StrongPity and Promethium
Synonyms: Lead as Winnti, Moonlight as MoleRats, FalloutTeam as DarkHotel, DustStorm as StonePanda, Skipper and Popeye as Pacifier
 2017-03-16 17:02:55 +01:00
Alexandre Dulaunoy e002e62204 missing \n at the end of the file 2017-03-01 14:55:45 +01:00
Chris Doman 9e5c983a65 Ran jq 2017-03-01 13:24:00 +00:00
Chris Doman e934f88b3b Added references 
Mostly added references to existing groups
Capitalised DarkHotel, put a space in APT30 default name (the others
had that)
 2017-03-01 12:53:52 +00:00
Alexandre Dulaunoy a224c7ce5e add: Gamaredon Group added 2017-02-28 09:17:33 +01:00
Christophe Vandeplas 048b831f53 minor correction 2017-02-27 11:00:48 +01:00
Thanat0s 3774f05237 Somes alias fetch from : https://attack.mitre.org/wiki/Groups 2017-02-26 23:07:42 +01:00
Raphaël Vinot 7db66e05dd Strict schema, update clusters accordingly 2017-02-14 11:34:59 +01:00
Raphaël Vinot 910398fe76 Fix validation, remove duplicate. 2017-02-13 18:52:54 +01:00
Alexandre Dulaunoy abca7a02d0 Greenbug added 2017-01-23 16:20:09 +01:00
Alexandre Dulaunoy 19406277d4
Equation Group added 2017-01-13 08:23:03 +01:00
Alexandre Dulaunoy 649c043ad2
Import manually cert-eu contribution 
- Fix the meta attributes (like the motive field ) to be within meta and not
   outside
 - Remove some "null" values that seems to come from previous tests
 - Pretty-print the Javascript (better for diffing)
 2017-01-09 23:07:57 +01:00
Alexandre Dulaunoy a6cb478a3b Separate APT30 from Naikon group 2017-01-06 22:26:53 +01:00
Alexandre Dulaunoy ea9ebaf5d6 PassCV group added 2017-01-06 13:51:22 +01:00
Alexandre Dulaunoy c3364add3c Cadelle and Chafer groups added 2017-01-06 13:25:30 +01:00
Alexandre Dulaunoy c38f62ae12 Packrat added 2016-12-30 12:47:47 +01:00
Alexandre Dulaunoy d37db31a75 Operation Iron Tiger added as synonym 2016-12-17 09:51:13 +01:00
Alexandre Dulaunoy 3deb47a9c8 Molerats, PROMETHIUM and NEODYMIUM added 2016-12-17 09:40:47 +01:00
Alexandre Dulaunoy ff17ac998e TeleBots group added 2016-12-13 19:37:30 +01:00
Alexandre Dulaunoy 3a657ace36 TERBIUM added 2016-12-13 09:11:16 +01:00
Alexandre Dulaunoy d834ec1f52 Singular everywhere 2016-12-04 17:37:29 +01:00