From 1a706d11eaa6c10b17f51a33a77f14a21e1ef12f Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 9 Jan 2025 03:10:46 -0800 Subject: [PATCH 1/5] [threat-actors] Add Natohub --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 65a8ebd0..a8ddf4a2 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -17624,6 +17624,16 @@ }, "uuid": "fba00660-d18c-4af7-831c-25757e495907", "value": "Wassonite" + }, + { + "description": "Natohub is a hacker who claimed to have stolen 42,000 documents from the UN’s International Civil Aviation Organization and is offering the data for sale on underground forums. The compromised documents allegedly contain personal records of ICAO staff and others associated with the agency. While ICAO is investigating the potential breach, Natohub has also made unverified claims about accessing personal data on thousands of UN delegates. The actor's track record of leaks is limited, raising questions about the credibility of their assertions.", + "meta": { + "refs": [ + "https://cisoseries.com/cyber-security-news-cyber-trust-label-uk-deepfake-laws-treasury-attack-details/" + ] + }, + "uuid": "43e2a6bc-0b62-456a-b5ae-a40770b8b8e1", + "value": "Natohub" } ], "version": 322 From 3eb10afba96ef1371d6671b4e71d3e915d5a3db2 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 9 Jan 2025 03:10:46 -0800 Subject: [PATCH 2/5] [threat-actors] Add CoughingDown --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index a8ddf4a2..68690db9 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -17634,6 +17634,16 @@ }, "uuid": "43e2a6bc-0b62-456a-b5ae-a40770b8b8e1", "value": "Natohub" + }, + { + "description": "CoughingDown is a threat group attributed to various cyber campaigns, including the deployment of the EAGERBEE backdoor, which utilizes service manipulation and privilege escalation techniques. The group has been linked to malware infrastructure that abuses legitimate services like MSDTC, IKEEXT, and SessionEnv to load malicious DLLs, including oci.dll. Analysis of supply-chain attacks, particularly involving Trojanized packages, has revealed similarities between CoughingDown malware and post-compromise tools used in these incidents. Evidence such as consistent service creation and C2 domain overlap further supports the connection between EAGERBEE and CoughingDown.", + "meta": { + "refs": [ + "https://securelist.com/eagerbee-backdoor/115175/" + ] + }, + "uuid": "80872d9a-1d0c-4c12-9543-feca1fbd2ac2", + "value": "CoughingDown" } ], "version": 322 From 380e9c1e862ad40602e2142e457525ea71d5f585 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 9 Jan 2025 03:10:46 -0800 Subject: [PATCH 3/5] [threat-actors] Add EC2 Grouper --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 68690db9..8d45b843 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -17644,6 +17644,16 @@ }, "uuid": "80872d9a-1d0c-4c12-9543-feca1fbd2ac2", "value": "CoughingDown" + }, + { + "description": "EC2 Grouper is a prolific threat actor known for leveraging AWS tools for PowerShell to conduct automated attacks in cloud environments. They typically utilize the CreateSecurityGroup API to establish remote access and exhibit a consistent security group naming convention. Credential acquisition is believed to stem from compromised cloud access keys, often sourced from public code repositories. Notably, their activities do not include calls to AuthorizeSecurityGroupIngress, suggesting a selective approach to escalation.", + "meta": { + "refs": [ + "https://www.fortinet.com/blog/threat-research/catching-ec2-grouper-no-indicators-required" + ] + }, + "uuid": "7f7b20e7-e704-4b47-b230-b5d232493fce", + "value": "EC2 Grouper" } ], "version": 322 From 927b55b36393ffa9b411801efd5edeacd952c02f Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 9 Jan 2025 03:10:46 -0800 Subject: [PATCH 4/5] [threat-actors] Add FIN6 aliases --- clusters/threat-actor.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 8d45b843..235688b5 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -3939,7 +3939,9 @@ "https://attack.mitre.org/groups/G0037/", "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/", "http://www.secureworks.com/research/threat-profiles/gold-franklin", - "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/" + "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/", + "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta4557-targets-recruiters-directly-email", + "https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers" ], "synonyms": [ "SKELETON SPIDER", @@ -3949,7 +3951,8 @@ "GOLD FRANKLIN", "ATK88", "G0037", - "Camouflage Tempest" + "Camouflage Tempest", + "TA4557" ] }, "related": [ From 75405a387e720471430d4c149f319f8a2c1bb59b Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 9 Jan 2025 03:10:47 -0800 Subject: [PATCH 5/5] [threat actors] Update README --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 53cebf6e..1059f20d 100644 --- a/README.md +++ b/README.md @@ -599,7 +599,7 @@ Category: *tea-matrix* - source: ** - total: *7* elements [Threat Actor](https://www.misp-galaxy.org/threat-actor) - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. threat-actor-classification meta can be used to clarify the understanding of the threat-actor if also considered as operation, campaign or activity group. -Category: *actor* - source: *MISP Project* - total: *793* elements +Category: *actor* - source: *MISP Project* - total: *796* elements [[HTML](https://www.misp-galaxy.org/threat-actor)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/threat-actor.json)]