Microsoft Activity Group actor
Activity groups as described by Microsoft
Authors
| Authors and/or Contributors |
|---|
| Various |
PROMETHIUM
PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.
Internal MISP references
UUID 5744f91a-d2d8-4f92-920f-943dd80c578f which can be used as unique global reference for PROMETHIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
NEODYMIUM
NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.
Internal MISP references
UUID 47b5007a-3fb1-466a-9578-629e6e735493 which can be used as unique global reference for NEODYMIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
TERBIUM
Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.
Internal MISP references
UUID 99784b80-6298-45ba-885c-0ed37bfd8324 which can be used as unique global reference for TERBIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
STRONTIUM
STRONTIUM has been active since at least 2007. Whereas most modern untargeted malware is ultimately profit-oriented, STRONTIUM mainly seeks sensitive information. Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries. Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia. STRONTIUM is an activity group that usually targets government agencies, diplomatic institutions, and military organizations, as well as affiliated private sector organizations such as defense contractors and public policy research institutes. Microsoft has attributed more 0-day exploits to STRONTIUM than any other tracked group in 2016. STRONTIUM frequently uses compromised e-mail accounts from one victim to send malicious e-mails to a second victim and will persistently pursue specific targets for months until they are successful in compromising the victims’ computer.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular STRONTIUM.
| Known Synonyms |
|---|
APT 28 |
APT28 |
Fancy Bear |
Grey-Cloud |
Group-4127 |
Pawn Storm |
Sednit |
Sofacy |
TG-4127 |
TsarTeam |
Internal MISP references
UUID 213cdde9-c11a-4ea9-8ce0-c868e9826fec which can be used as unique global reference for STRONTIUM in MISP communities and other software using the MISP galaxy
External references
- https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/ - webarchive
- http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_A_Profile_Of_A_Persistent_Adversary_English.pdf - webarchive
- https://blogs.technet.microsoft.com/mmpc/2015/11/16/microsoft-security-intelligence-report-strontium/ - webarchive
- https://blogs.microsoft.com/on-the-issues/2018/08/20/we-are-taking-new-steps-against-broadening-threats-to-democracy/ - webarchive
- https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
Related clusters
To see the related clusters, click here.
DUBNIUM
DUBNIUM (which shares indicators with what Kaspersky researchers have called DarkHotel) is one of the activity groups that has been very active in recent years, and has many distinctive features.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DUBNIUM.
| Known Synonyms |
|---|
darkhotel |
Internal MISP references
UUID b56af6ab-69f8-457a-bf50-c3aefa6dc14a which can be used as unique global reference for DUBNIUM in MISP communities and other software using the MISP galaxy
External references
- https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/ - webarchive
- https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2 - webarchive
- https://blogs.technet.microsoft.com/mmpc/2016/06/20/reverse-engineering-dubniums-flash-targeting-exploit/ - webarchive
- https://blogs.technet.microsoft.com/mmpc/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/ - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
PLATINUM
PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.
Internal MISP references
UUID 154e97b5-47ef-415a-99a6-2157f1b50339 which can be used as unique global reference for PLATINUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
BARIUM
Microsoft Threat Intelligence associates Winnti with multiple activity groups—collections of malware, supporting infrastructure, online personas, victimology, and other attack artifacts that the Microsoft intelligent security graph uses to categorize and attribute threat activity. Microsoft labels activity groups using code names derived from elements in the periodic table. In the case of this malware, the activity groups strongly associated with Winnti are BARIUM and LEAD. But even though they share the use of Winnti, the BARIUM and LEAD activity groups are involved in very different intrusion scenarios. BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms. Once BARIUM has established rapport, they spear-phish the victim using a variety of unsophisticated malware installation vectors, including malicious shortcut (.lnk) files with hidden payloads, compiled HTML help (.chm) files, or Microsoft Office documents containing macros or exploits. Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles, collaborative document editing sites, and blogs for C&C. Later stages of the intrusions rely upon Winnti for persistent access. The majority of victims recorded to date have been in electronic gaming, multimedia, and Internet content industries, although occasional intrusions against technology companies have occurred.
Internal MISP references
UUID cc70bdbd-afa7-4e19-bba2-2443811ef3af which can be used as unique global reference for BARIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
LEAD
In contrast, LEAD has established a far greater reputation for industrial espionage. In the past few years, LEAD’s victims have included: Multinational, multi-industry companies involved in the manufacture of textiles, chemicals, and electronics Pharmaceutical companies A company in the chemical industry University faculty specializing in aeronautical engineering and research A company involved in the design and manufacture of motor vehicles A cybersecurity company focusing on protecting industrial control systems During these intrusions, LEAD’s objective was to steal sensitive data, including research materials, process documents, and project plans. LEAD also steals code-signing certificates to sign its malware in subsequent attacks. In most cases, LEAD’s attacks do not feature any advanced exploit techniques. The group also does not make special effort to cultivate victims prior to an attack. Instead, the group often simply emails a Winnti installer to potential victims, relying on basic social engineering tactics to convince recipients to run the attached malware. In some other cases, LEAD gains access to a target by brute-forcing remote access login credentials, performing SQL injection, or exploiting unpatched web servers, and then they copy the Winnti installer directly to compromised machines.
Internal MISP references
UUID f542442e-ba0f-425d-b386-6c10351a468e which can be used as unique global reference for LEAD in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
ZIRCONIUM
In addition to strengthening generic detection of EoP exploits, Microsoft security researchers are actively gathering threat intelligence and indicators attributable to ZIRCONIUM, the activity group using the CVE-2017-0005 exploit.
Internal MISP references
UUID 2d19c573-252b-49d8-8c2e-3b529b91e72d which can be used as unique global reference for ZIRCONIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
GALLIUM
Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers. When Microsoft customers have been targeted by this activity, we notified them directly with the relevant information they need to protect themselves. By sharing the detailed methodology and indicators related to GALLIUM activity, we’re encouraging the security community to implement active defenses to secure the broader ecosystem from these attacks. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss. Once persistence is established in a network, GALLIUM uses common techniques and tools like Mimikatz to obtain credentials that allows for lateral movement across the target network. Within compromised networks, GALLIUM makes no attempt to obfuscate their intent and are known to use common versions of malware and publicly available toolkits with small modifications. The operators rely on low cost and easy to replace infrastructure that consists of dynamic-DNS domains and regularly reused hop points. This activity from GALLIUM has been identified predominantly through 2018 to mid-2019. GALLIUM is still active; however, activity levels have dropped when compared to what was previously observed.
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GALLIUM.
| Known Synonyms |
|---|
Operation Soft Cell |
Internal MISP references
UUID 6085aad0-1d95-11ea-a140-078d42aced40 which can be used as unique global reference for GALLIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
PARINACOTA
One actor that has emerged in this trend of human-operated attacks is an active, highly adaptive group that frequently drops Wadhrama as payload. PARINACOTA impacts three to four organizations every week and appears quite resourceful: during the 18 months that we have been monitoring it, we have observed the group change tactics to match its needs and use compromised machines for various purposes, including cryptocurrency mining, sending spam emails, or proxying for other attacks. The group’s goals and payloads have shifted over time, influenced by the type of compromised infrastructure, but in recent months, they have mostly deployed the Wadhrama ransomware. The group most often employs a smash-and-grab method, whereby they attempt to infiltrate a machine in a network and proceed with subsequent ransom in less than an hour. There are outlier campaigns in which they attempt reconnaissance and lateral movement, typically when they land on a machine and network that allows them to quickly and easily move throughout the environment. PARINACOTA’s attacks typically brute forces their way into servers that have Remote Desktop Protocol (RDP) exposed to the internet, with the goal of moving laterally inside a network or performing further brute-force activities against targets outside the network. This allows the group to expand compromised infrastructure under their control. Frequently, the group targets built-in local administrator accounts or a list of common account names. In other instances, the group targets Active Directory (AD) accounts that they compromised or have prior knowledge of, such as service accounts of known vendors. The group adopted the RDP brute force technique that the older ransomware called Samas (also known as SamSam) infamously used. Other malware families like GandCrab, MegaCortext, LockerGoga, Hermes, and RobbinHood have also used this method in targeted ransomware attacks. PARINACOTA, however, has also been observed to adapt to any path of least resistance they can utilize. For instance, they sometimes discover unpatched systems and use disclosed vulnerabilities to gain initial access or elevate privileges.
Internal MISP references
UUID 00edb40d-2fed-4d36-98b1-c85fc2bb1168 which can be used as unique global reference for PARINACOTA in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
GADOLINIUM
GADOLINIUM is a nation-state activity group that has been compromising targets for nearly a decade with a worldwide focus on the maritime and health industries. As with most threat groups, GADOLINIUM tracks the tools and techniques of security practitioners looking for new techniques they can use or modify to create new exploit methods. Historically, GADOLINIUM used custom-crafted malware families that analysts can identify and defend against. In response, over the last year GADOLINIUM has begun to modify portions of its toolchain to use open-source toolkits to obfuscate their activity and make it more difficult for analysts to track. Because cloud services frequently offer a free trial or one-time payment (PayGo) account offerings, malicious actors have found ways to take advantage of these legitimate business offerings. By establishing free or PayGo accounts, they can use cloud-based technology to create a malicious infrastructure that can be established quickly then taken down before detection or given up at little cost.
Internal MISP references
UUID 99e708f7-1c01-467d-b0da-f6cebd434abc which can be used as unique global reference for GADOLINIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
HAFNIUM
HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA. In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States.
Internal MISP references
UUID fbb66d6c-0faa-49cc-8aa3-2f9bd4e9c298 which can be used as unique global reference for HAFNIUM in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
NOBELIUM
Threat actor behind the attacks against SolarWinds, the SUNBURST backdoor, TEARDROP malware, GoldMax malware.
Internal MISP references
UUID d7247cf9-13b6-4781-b789-a5f33521633b which can be used as unique global reference for NOBELIUM in MISP communities and other software using the MISP galaxy
External references
- https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - webarchive
- https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html - webarchive
Associated metadata
| Metadata key | Value |
|---|---|
Related clusters
To see the related clusters, click here.
Aqua Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aqua Blizzard.
| Known Synonyms |
|---|
ACTINIUM |
Gamaredon |
Primitive Bear |
UNC530 |
Internal MISP references
UUID fc77a775-d06f-5efc-a6fa-0b2af01902a7 which can be used as unique global reference for Aqua Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Brass Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Brass Typhoon.
| Known Synonyms |
|---|
APT41 |
BARIUM |
Internal MISP references
UUID 2fc42ffc-dd1a-560e-ac97-05e8fa27bbe5 which can be used as unique global reference for Brass Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Cadet Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cadet Blizzard.
| Known Synonyms |
|---|
DEV-0586 |
Internal MISP references
UUID 7f190457-6829-55c4-9b6b-bccdadb747cb which can be used as unique global reference for Cadet Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Camouflage Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Camouflage Tempest.
| Known Synonyms |
|---|
FIN6 |
Skeleton Spider |
TAAL |
Internal MISP references
UUID 3126bd2c-3d04-5174-ad03-40136b94f574 which can be used as unique global reference for Camouflage Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Canvas Cyclone
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Canvas Cyclone.
| Known Synonyms |
|---|
APT32 |
BISMUTH |
OceanLotus |
Internal MISP references
UUID 37808cab-cbb3-560b-bebd-375fa328ea1e which can be used as unique global reference for Canvas Cyclone in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | VN |
| sector | Vietnam |
Related clusters
To see the related clusters, click here.
Caramel Tsunami
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Caramel Tsunami.
| Known Synonyms |
|---|
Candiru |
SOURGUM |
Internal MISP references
UUID 1b15288c-ff19-5f52-8c4b-6185de934ff8 which can be used as unique global reference for Caramel Tsunami in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Private sector offensive actor |
Carmine Tsunami
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Carmine Tsunami.
| Known Synonyms |
|---|
DEV-0196 |
QuaDream |
Internal MISP references
UUID ab6940c3-a2f0-5802-9270-87f15f2e168a which can be used as unique global reference for Carmine Tsunami in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Private sector offensive actor |
Charcoal Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Charcoal Typhoon.
| Known Synonyms |
|---|
CHROMIUM |
ControlX |
Internal MISP references
UUID 3f8b7c98-7484-523f-9d58-181274e6fc8f which can be used as unique global reference for Charcoal Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Cinnamon Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cinnamon Tempest.
| Known Synonyms |
|---|
Bronze Starlight |
DEV-0401 |
Emperor Dragonfly |
Internal MISP references
UUID 43fe584d-88e5-5f2b-a9fd-a866e62040bb which can be used as unique global reference for Cinnamon Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Circle Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Circle Typhoon.
| Known Synonyms |
|---|
DEV-0322 |
Internal MISP references
UUID 0bebd962-191a-5671-b5b0-f6de7c8180fc which can be used as unique global reference for Circle Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Cotton Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cotton Sandstorm.
| Known Synonyms |
|---|
DEV-0198 |
NEPTUNIUM |
Vice Leaker |
Internal MISP references
UUID b06ff51a-77e7-5b7f-9938-4a2d37bce5a4 which can be used as unique global reference for Cotton Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Crimson Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Crimson Sandstorm.
| Known Synonyms |
|---|
CURIUM |
TA456 |
Tortoise Shell |
Internal MISP references
UUID b76e22b0-26a4-50ca-b876-09bc90a81b3b which can be used as unique global reference for Crimson Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Cuboid Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cuboid Sandstorm.
| Known Synonyms |
|---|
DEV-0228 |
Internal MISP references
UUID badacab7-5097-5817-8516-d8a72de2a71b which can be used as unique global reference for Cuboid Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Denim Tsunami
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Denim Tsunami.
| Known Synonyms |
|---|
DSIRF |
KNOTWEED |
Internal MISP references
UUID 9a4a662a-84a9-5b86-b241-7c5eef9cea4d which can be used as unique global reference for Denim Tsunami in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Private sector offensive actor |
Diamond Sleet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Diamond Sleet.
| Known Synonyms |
|---|
Labyrinth Chollima |
Lazarus |
ZINC |
Internal MISP references
UUID 9630b0aa-ee9e-5b58-9f79-cf7fa8d291a8 which can be used as unique global reference for Diamond Sleet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KP |
| sector | North Korea |
Related clusters
To see the related clusters, click here.
Emerald Sleet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emerald Sleet.
| Known Synonyms |
|---|
Kimsuky |
THALLIUM |
Velvet Chollima |
Internal MISP references
UUID 44be06b1-e17a-5ea6-a0a2-067933a7af77 which can be used as unique global reference for Emerald Sleet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KP |
| sector | North Korea |
Related clusters
To see the related clusters, click here.
Forest Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Forest Blizzard.
| Known Synonyms |
|---|
APT28 |
Fancy Bear |
STRONTIUM |
Internal MISP references
UUID 8d84d7b0-7716-5ab3-a3a4-f373dd148347 which can be used as unique global reference for Forest Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Ghost Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ghost Blizzard.
| Known Synonyms |
|---|
BROMINE |
Crouching Yeti |
Energetic Bear |
Internal MISP references
UUID 45d0f984-2b63-517b-922a-12924bcf4f68 which can be used as unique global reference for Ghost Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Gingham Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gingham Typhoon.
| Known Synonyms |
|---|
APT40 |
GADOLINIUM |
Kryptonite Panda |
Leviathan |
TEMP.Periscope |
Internal MISP references
UUID dbc45b46-5b64-50d4-b0f1-d7de888d4e85 which can be used as unique global reference for Gingham Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Granite Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Granite Typhoon.
| Known Synonyms |
|---|
GALLIUM |
Internal MISP references
UUID ae4036de-c901-5f21-808a-f5c071ef509b which can be used as unique global reference for Granite Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Gray Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gray Sandstorm.
| Known Synonyms |
|---|
DEV-0343 |
Internal MISP references
UUID 395473c6-be98-5369-82d1-cdbc97b3fddc which can be used as unique global reference for Gray Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Hazel Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hazel Sandstorm.
| Known Synonyms |
|---|
APT34 |
Cobalt Gypsy |
EUROPIUM |
OilRig |
Internal MISP references
UUID b6260d6d-a2f7-5b79-8132-5c456a225f53 which can be used as unique global reference for Hazel Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Related clusters
To see the related clusters, click here.
Lace Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lace Tempest.
| Known Synonyms |
|---|
DEV-0950 |
FIN11 |
TA505 |
Internal MISP references
UUID b27dcdee-14b1-5842-86b3-32eacec94584 which can be used as unique global reference for Lace Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Lemon Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lemon Sandstorm.
| Known Synonyms |
|---|
Fox Kitten |
PioneerKitten |
RUBIDIUM |
UNC757 |
Internal MISP references
UUID 0757856a-1313-57d8-bb6c-f4c537e110da which can be used as unique global reference for Lemon Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Related clusters
To see the related clusters, click here.
Lilac Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lilac Typhoon.
| Known Synonyms |
|---|
DEV-0234 |
Internal MISP references
UUID aa45a89c-4c2b-5f6b-9a3d-51abccaa9623 which can be used as unique global reference for Lilac Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Manatee Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Manatee Tempest.
| Known Synonyms |
|---|
DEV-0243 |
EvilCorp |
Indrik Spider |
UNC2165 |
Internal MISP references
UUID b19bc1a0-2489-56ae-aa61-ed147310363e which can be used as unique global reference for Manatee Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Mango Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mango Sandstorm.
| Known Synonyms |
|---|
MERCURY |
MuddyWater |
SeedWorm |
Static Kitten |
TEMP.Zagros |
Internal MISP references
UUID da68ca6d-250f-50f1-a585-240475fdbb35 which can be used as unique global reference for Mango Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Related clusters
To see the related clusters, click here.
Marbled Dust
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Marbled Dust.
| Known Synonyms |
|---|
SILICON |
Sea Turtle |
Internal MISP references
UUID fc91881e-92c0-5a63-a0b9-b253958a594e which can be used as unique global reference for Marbled Dust in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | TR |
| sector | Turkey |
Related clusters
To see the related clusters, click here.
Marigold Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Marigold Sandstorm.
| Known Synonyms |
|---|
DEV-0500 |
Moses Staff |
Internal MISP references
UUID ef415059-e150-5324-877e-44b65ab022f5 which can be used as unique global reference for Marigold Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Related clusters
To see the related clusters, click here.
Midnight Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Midnight Blizzard.
| Known Synonyms |
|---|
APT29 |
Cozy Bear |
NOBELIUM |
Internal MISP references
UUID 31982812-c8bf-5e85-b0ba-0c64a7d05d20 which can be used as unique global reference for Midnight Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Mint Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mint Sandstorm.
| Known Synonyms |
|---|
APT35 |
Charming Kitten |
PHOSPHORUS |
Internal MISP references
UUID 400cd1b8-52b7-5a5c-984f-9b4af35ea231 which can be used as unique global reference for Mint Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Related clusters
To see the related clusters, click here.
Mulberry Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mulberry Typhoon.
| Known Synonyms |
|---|
APT5 |
Keyhole Panda |
MANGANESE |
TABCTENG |
Internal MISP references
UUID fa562b27-d3ff-5e7c-9079-c957eb01a0e0 which can be used as unique global reference for Mulberry Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Mustard Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mustard Tempest.
| Known Synonyms |
|---|
DEV-0206 |
Purple Vallhund |
Internal MISP references
UUID 1b1524f4-16b0-5b85-aea4-844babea4ccb which can be used as unique global reference for Mustard Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Night Tsunami
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Night Tsunami.
| Known Synonyms |
|---|
DEV-0336 |
NSO Group |
Internal MISP references
UUID af54315b-3561-5046-8b9b-c3e9e05c0f77 which can be used as unique global reference for Night Tsunami in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Private sector offensive actor |
Nylon Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nylon Typhoon.
| Known Synonyms |
|---|
APT15 |
NICKEL |
Vixen Panda |
ke3chang |
Internal MISP references
UUID 66571167-13fe-5817-93e0-54ae8f206fdc which can be used as unique global reference for Nylon Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Opal Sleet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Opal Sleet.
| Known Synonyms |
|---|
Konni |
OSMIUM |
Internal MISP references
UUID 5163b2d9-7521-5225-a7a8-88d881fbc406 which can be used as unique global reference for Opal Sleet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KP |
| sector | North Korea |
Peach Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Peach Sandstorm.
| Known Synonyms |
|---|
APT33 |
HOLMIUM |
Refined Kitten |
Internal MISP references
UUID 4c0f085a-70b1-5ee6-a45a-dc368f03e701 which can be used as unique global reference for Peach Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Related clusters
To see the related clusters, click here.
Pearl Sleet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pearl Sleet.
| Known Synonyms |
|---|
DEV-0215 |
LAWRENCIUM |
Internal MISP references
UUID 1c5c67ad-c241-5103-99d0-daab5a554b0d which can be used as unique global reference for Pearl Sleet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KP |
| sector | North Korea |
Periwinkle Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Periwinkle Tempest.
| Known Synonyms |
|---|
DEV-0193 |
UNC2053 |
Wizard Spider |
Internal MISP references
UUID 120dc1ae-e850-5059-a4fb-520748ca6881 which can be used as unique global reference for Periwinkle Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Phlox Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Phlox Tempest.
| Known Synonyms |
|---|
Choziosi loader |
Chrome Loader |
ClickPirate |
DEV-0796 |
Internal MISP references
UUID 3c9a0350-8d17-5624-872c-fe44969a5888 which can be used as unique global reference for Phlox Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Pink Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pink Sandstorm.
| Known Synonyms |
|---|
AMERICIUM |
Agrius |
BlackShadow |
DEV-0227 |
Deadwood |
SharpBoys |
Internal MISP references
UUID cca311c0-dc91-5aee-b282-5e412040dac3 which can be used as unique global reference for Pink Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Pistachio Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pistachio Tempest.
| Known Synonyms |
|---|
DEV-0237 |
FIN12 |
Internal MISP references
UUID 567ea386-a78f-5550-ae7c-9c9eacdf45af which can be used as unique global reference for Pistachio Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Plaid Rain
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Plaid Rain.
| Known Synonyms |
|---|
POLONIUM |
Internal MISP references
UUID ce5357da-0e15-5022-bd4f-74aa689d0b2e which can be used as unique global reference for Plaid Rain in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | LB |
| sector | Lebanon |
Related clusters
To see the related clusters, click here.
Pumpkin Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pumpkin Sandstorm.
| Known Synonyms |
|---|
DEV-0146 |
ZeroCleare |
Internal MISP references
UUID 562049d7-78f5-5a65-b7db-c509c9f483f7 which can be used as unique global reference for Pumpkin Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Raspberry Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Raspberry Typhoon.
| Known Synonyms |
|---|
APT30 |
LotusBlossom |
RADIUM |
Internal MISP references
UUID b3c378fc-1ce3-5a46-a32e-f55a584c6536 which can be used as unique global reference for Raspberry Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Ruby Sleet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ruby Sleet.
| Known Synonyms |
|---|
CERIUM |
Internal MISP references
UUID c29e7262-6a6f-501d-8c00-57f75f2172a3 which can be used as unique global reference for Ruby Sleet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KP |
| sector | North Korea |
Sangria Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sangria Tempest.
| Known Synonyms |
|---|
Carbon Spider |
ELBRUS |
FIN7 |
Internal MISP references
UUID 9471ad21-0553-5483-bf7c-e6ad9c062c79 which can be used as unique global reference for Sangria Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Sapphire Sleet
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sapphire Sleet.
| Known Synonyms |
|---|
BlueNoroff |
COPERNICIUM |
Genie Spider |
Internal MISP references
UUID 3a32c54d-d86a-55de-b16a-d9a08a5cf49b which can be used as unique global reference for Sapphire Sleet in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KP |
| sector | North Korea |
Related clusters
To see the related clusters, click here.
Seashell Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Seashell Blizzard.
| Known Synonyms |
|---|
IRIDIUM |
Sandworm |
Internal MISP references
UUID 473eb51c-36cb-5e3a-8347-2f57df809be9 which can be used as unique global reference for Seashell Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Secret Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Secret Blizzard.
| Known Synonyms |
|---|
KRYPTON |
Snake |
Turla |
Venomous Bear |
Internal MISP references
UUID 8d19da8a-d0fa-5194-ad6f-315cc4f36c8b which can be used as unique global reference for Secret Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Silk Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Silk Typhoon.
| Known Synonyms |
|---|
HAFNIUM |
Internal MISP references
UUID 9728610a-17cb-5cac-9322-ef19ae296a29 which can be used as unique global reference for Silk Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Smoke Sandstorm
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Smoke Sandstorm.
| Known Synonyms |
|---|
BOHRIUM |
Internal MISP references
UUID 4426d375-1435-5ccc-8c1f-f8688bd11f80 which can be used as unique global reference for Smoke Sandstorm in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | IR |
| sector | Iran |
Spandex Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Spandex Tempest.
| Known Synonyms |
|---|
CHIMBORAZO |
TA505 |
Internal MISP references
UUID c85120d0-c397-5d30-9d57-3b019090acd5 which can be used as unique global reference for Spandex Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Star Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Star Blizzard.
| Known Synonyms |
|---|
Callisto |
Reuse Team |
SEABORGIUM |
Internal MISP references
UUID 06630ccd-98ed-5aec-8083-e04c894bd2d6 which can be used as unique global reference for Star Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Related clusters
To see the related clusters, click here.
Storm-0257
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0257.
| Known Synonyms |
|---|
DEV-0257 |
UNC1151 |
Internal MISP references
UUID 60ac9e2c-b3b2-5c6b-913e-935952e14c28 which can be used as unique global reference for Storm-0257 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Group in development |
Related clusters
To see the related clusters, click here.
Storm-0530
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0530.
| Known Synonyms |
|---|
DEV-0530 |
H0lyGh0st |
Internal MISP references
UUID ab314f1c-8d07-5edb-bb32-64d1105f74ff which can be used as unique global reference for Storm-0530 in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KP |
| sector | North Korea |
Strawberry Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Strawberry Tempest.
| Known Synonyms |
|---|
DEV-0537 |
LAPSUS$ |
Internal MISP references
UUID d4dfb329-822c-5db3-a078-a8c0f77924da which can be used as unique global reference for Strawberry Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Sunglow Blizzard
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sunglow Blizzard.
| Known Synonyms |
|---|
DEV-0665 |
Internal MISP references
UUID 79f8646f-d127-51b7-b502-b096b445c322 which can be used as unique global reference for Sunglow Blizzard in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | RU |
| sector | Russia |
Tomato Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tomato Tempest.
| Known Synonyms |
|---|
SPURR |
Vatet |
Internal MISP references
UUID 028b667a-1102-5b1e-9726-edbf145d9d8f which can be used as unique global reference for Tomato Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Vanilla Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Vanilla Tempest.
| Known Synonyms |
|---|
DEV-0832 |
Internal MISP references
UUID a01da064-988c-5ad3-92c6-9537adb6a5f0 which can be used as unique global reference for Vanilla Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Velvet Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Velvet Tempest.
| Known Synonyms |
|---|
DEV-0504 |
Internal MISP references
UUID 0662a721-a92e-50b3-a5ac-0c4142ac9aeb which can be used as unique global reference for Velvet Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Violet Typhoon
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Violet Typhoon.
| Known Synonyms |
|---|
APT31 |
ZIRCONIUM |
Internal MISP references
UUID 27eb4928-b3e6-5ae1-bbb6-f73bce8d7c69 which can be used as unique global reference for Violet Typhoon in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | CN |
| sector | China |
Related clusters
To see the related clusters, click here.
Wine Tempest
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wine Tempest.
| Known Synonyms |
|---|
PARINACOTA |
Wadhrama |
Internal MISP references
UUID 5939e42e-06d0-5719-8072-62f0fc0821e8 which can be used as unique global reference for Wine Tempest in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Financially motivated |
Related clusters
To see the related clusters, click here.
Wisteria Tsunami
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wisteria Tsunami.
| Known Synonyms |
|---|
CyberRoot |
DEV-0605 |
Internal MISP references
UUID 2263b6c9-861a-5971-b882-9ea4a84fcf74 which can be used as unique global reference for Wisteria Tsunami in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| sector | Private sector offensive actor |
Zigzag Hail
Synonyms
"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zigzag Hail.
| Known Synonyms |
|---|
DUBNIUM |
Dark Hotel |
Tapaoux |
Internal MISP references
UUID 0a4ddab3-a1a6-5372-b11f-5edc25c0e548 which can be used as unique global reference for Zigzag Hail in MISP communities and other software using the MISP galaxy
External references
Associated metadata
| Metadata key | Value |
|---|---|
| country | KR |
| sector | South Korea |
Related clusters
To see the related clusters, click here.