Hide Navigation Hide TOC

Edit

Microsoft Activity Group actor

Activity groups as described by Microsoft

Authors

Authors and/or Contributors
Various

Amethyst Rain

Microsoft threat actor profile. Origin/Threat: Lebanon.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Amethyst Rain.

Known Synonyms
Volatile Cedar
VolcanicTimber

Internal MISP references

UUID 043ebe48-3101-5f67-9dd0-de3c9f230031 which can be used as unique global reference for Amethyst Rain in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	LB
microsoft-origin-threat	Lebanon

Antique Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Antique Typhoon.

Known Synonyms
Storm-0558

Internal MISP references

UUID ae55260b-eafa-5492-bfa1-19676ade75d2 which can be used as unique global reference for Antique Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Aqua Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aqua Blizzard.

Known Synonyms
ACTINIUM
Armageddon
Gamaredon
Primitive Bear
SectorC08
UNC530
shuckworm

Internal MISP references

UUID fc77a775-d06f-5efc-a6fa-0b2af01902a7 which can be used as unique global reference for Aqua Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

BARIUM

Microsoft Threat Intelligence associates Winnti with multiple activity groups—collections of malware, supporting infrastructure, online personas, victimology, and other attack artifacts that the Microsoft intelligent security graph uses to categorize and attribute threat activity. Microsoft labels activity groups using code names derived from elements in the periodic table. In the case of this malware, the activity groups strongly associated with Winnti are BARIUM and LEAD. But even though they share the use of Winnti, the BARIUM and LEAD activity groups are involved in very different intrusion scenarios. BARIUM begins its attacks by cultivating relationships with potential victims—particularly those working in Business Development or Human Resources—on various social media platforms. Once BARIUM has established rapport, they spear-phish the victim using a variety of unsophisticated malware installation vectors, including malicious shortcut (.lnk) files with hidden payloads, compiled HTML help (.chm) files, or Microsoft Office documents containing macros or exploits. Initial intrusion stages feature the Win32/Barlaiy implant—notable for its use of social network profiles, collaborative document editing sites, and blogs for C&C. Later stages of the intrusions rely upon Winnti for persistent access. The majority of victims recorded to date have been in electronic gaming, multimedia, and Internet content industries, although occasional intrusions against technology companies have occurred.

Internal MISP references

UUID cc70bdbd-afa7-4e19-bba2-2443811ef3af which can be used as unique global reference for BARIUM in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Berry Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Berry Sandstorm.

Known Synonyms
Storm-0852

Internal MISP references

UUID 7482e4fa-ae4e-5827-a357-46b1a55c4f59 which can be used as unique global reference for Berry Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran

Blue Tsunami

Microsoft threat actor profile. Origin/Threat: Israel, Private sector offensive actor.

Internal MISP references

UUID 258a5cd1-f040-5a2e-8f04-6787bf2f1ae7 which can be used as unique global reference for Blue Tsunami in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IL
microsoft-origin-threat	Israel, Private sector offensive actor

Brass Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Brass Typhoon.

Known Synonyms
APT41
BARIUM
WICKED PANDA

Internal MISP references

UUID 2fc42ffc-dd1a-560e-ac97-05e8fa27bbe5 which can be used as unique global reference for Brass Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Brocade Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Brocade Typhoon.

Known Synonyms
APT3
BORON
CYBRAN
GOTHIC PANDA
OLDCARP
Red Sylvan
TG-0110
UPS

Internal MISP references

UUID 53f1281b-790d-5183-9306-b1b1ac38b715 which can be used as unique global reference for Brocade Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Burgundy Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Burgundy Sandstorm.

Known Synonyms
Cadelle
Chafer
REMIX KITTEN

Internal MISP references

UUID 855828a7-8e3d-5ee7-8c5c-8bb619f6db6c which can be used as unique global reference for Burgundy Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran

Cadet Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cadet Blizzard.

Known Synonyms
DEV-0586
EMBER BEAR

Internal MISP references

UUID 7f190457-6829-55c4-9b6b-bccdadb747cb which can be used as unique global reference for Cadet Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

Camouflage Tempest

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Camouflage Tempest.

Known Synonyms
FIN6
Skeleton Spider
TAAL

Internal MISP references

UUID 3126bd2c-3d04-5174-ad03-40136b94f574 which can be used as unique global reference for Camouflage Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive

Associated metadata

Metadata key	Value
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Canary Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Canary Typhoon.

Known Synonyms
APT24
BlackTech
CIRCUIT PANDA
Palmerworm

Internal MISP references

UUID 59b25baf-5d3b-5e98-824a-2a0b0764e961 which can be used as unique global reference for Canary Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Canvas Cyclone

Microsoft threat actor profile. Origin/Threat: Vietnam.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Canvas Cyclone.

Known Synonyms
APT32
BISMUTH
OCEAN BUFFALO
OceanLotus

Internal MISP references

UUID 37808cab-cbb3-560b-bebd-375fa328ea1e which can be used as unique global reference for Canvas Cyclone in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	VN
microsoft-origin-threat	Vietnam
sector	Vietnam

Related clusters

To see the related clusters, click here.

Caramel Tsunami

Microsoft threat actor profile. Origin/Threat: Israel, Private sector offensive actor.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Caramel Tsunami.

Known Synonyms
Candiru
DEV-0236
SOURGUM

Internal MISP references

UUID 1b15288c-ff19-5f52-8c4b-6185de934ff8 which can be used as unique global reference for Caramel Tsunami in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IL
microsoft-origin-threat	Israel, Private sector offensive actor
sector	Private sector offensive actor

Carmine Tsunami

Microsoft threat actor profile. Origin/Threat: Private sector offensive actor.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Carmine Tsunami.

Known Synonyms
DEV-0196
QuaDream

Internal MISP references

UUID ab6940c3-a2f0-5802-9270-87f15f2e168a which can be used as unique global reference for Carmine Tsunami in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Private sector offensive actor
sector	Private sector offensive actor

Charcoal Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Charcoal Typhoon.

Known Synonyms
AQUATIC PANDA
BRONZE UNIVERSITY
CHROMIUM
ControlX
RedHotel

Internal MISP references

UUID 3f8b7c98-7484-523f-9d58-181274e6fc8f which can be used as unique global reference for Charcoal Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Checkered Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Checkered Typhoon.

Known Synonyms
APT19
ATG50
CHLORINE
DEEP PANDA
Red Gargoyle
TG-3551

Internal MISP references

UUID df9c1947-9c78-5538-b4b8-a6385e77c5bb which can be used as unique global reference for Checkered Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Cinnamon Tempest

Microsoft threat actor profile. Origin/Threat: China, Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cinnamon Tempest.

Known Synonyms
Bronze Starlight
DEV-0401
Emperor Dragonfly
HighGround

Internal MISP references

UUID 43fe584d-88e5-5f2b-a9fd-a866e62040bb which can be used as unique global reference for Cinnamon Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China, Financially motivated
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Circle Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Circle Typhoon.

Known Synonyms
APT27
APT6
DEV-0322
EMISSARY PANDA

Internal MISP references

UUID 0bebd962-191a-5671-b5b0-f6de7c8180fc which can be used as unique global reference for Circle Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Citrine Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Citrine Sleet.

Known Synonyms
LABYRINTH CHOLLIMA
Storm-0139
Storm-1222

Internal MISP references

UUID c4004152-f87a-5052-b02b-5602ee3c0fd3 which can be used as unique global reference for Citrine Sleet in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea

Clay Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Clay Typhoon.

Known Synonyms
Storm-2416

Internal MISP references

UUID 5730cf0f-286d-5f10-9eb0-e5242ec87f08 which can be used as unique global reference for Clay Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Copper Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Copper Typhoon.

Known Synonyms
Earth Akhlut
Sharp-R
Tonto Team

Internal MISP references

UUID 32525044-46ee-54c1-a81d-90ee1b9abeb4 which can be used as unique global reference for Copper Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Coral Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Coral Sleet.

Known Synonyms
Storm-1877

Internal MISP references

UUID 7146aa01-7139-54d7-bd58-d9be2957b64e which can be used as unique global reference for Coral Sleet in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea

Cotton Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cotton Sandstorm.

Known Synonyms
DEV-0198
HAYWIRE KITTEN
NEPTUNIUM
Vice Leaker

Internal MISP references

UUID b06ff51a-77e7-5b7f-9938-4a2d37bce5a4 which can be used as unique global reference for Cotton Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

CovertNetwork-1658

Microsoft threat actor profile. Origin/Threat: Covert network.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CovertNetwork-1658.

Known Synonyms
ORB07

Internal MISP references

UUID 8fe1ecdc-5718-5a05-9778-df58c0687b32 which can be used as unique global reference for CovertNetwork-1658 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Covert network

Crescent Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Crescent Typhoon.

Known Synonyms
CESIUM

Internal MISP references

UUID f0321b6d-ba72-556c-b2eb-df47e188ad5c which can be used as unique global reference for Crescent Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Crimson Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Crimson Sandstorm.

Known Synonyms
CURIUM
HOUSEBLEND
IMPERIAL KITTEN
TA456
Tortoise Shell

Internal MISP references

UUID b76e22b0-26a4-50ca-b876-09bc90a81b3b which can be used as unique global reference for Crimson Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Cuboid Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cuboid Sandstorm.

Known Synonyms
DEV-0228
IMPERIAL KITTEN

Internal MISP references

UUID badacab7-5097-5817-8516-d8a72de2a71b which can be used as unique global reference for Cuboid Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Daffodil Gust

Microsoft threat actor profile. Origin/Threat: United Arab Emirates.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Daffodil Gust.

Known Synonyms
Fruity Armor
Project Raven
Stealth Falcon

Internal MISP references

UUID 667c2c4e-42bf-5383-ac1d-8a875d6c03a8 which can be used as unique global reference for Daffodil Gust in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	AE
microsoft-origin-threat	United Arab Emirates

Denim Tsunami

Microsoft threat actor profile. Origin/Threat: Austria, Private sector offensive actor.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Denim Tsunami.

Known Synonyms
DEV-0291
DSIRF
KNOTWEED

Internal MISP references

UUID 9a4a662a-84a9-5b86-b241-7c5eef9cea4d which can be used as unique global reference for Denim Tsunami in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	AT
microsoft-origin-threat	Austria, Private sector offensive actor
sector	Private sector offensive actor

Diamond Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Diamond Sleet.

Known Synonyms
Black Artemis
Labyrinth Chollima
Lazarus
ZINC

Internal MISP references

UUID 9630b0aa-ee9e-5b58-9f79-cf7fa8d291a8 which can be used as unique global reference for Diamond Sleet in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea
sector	North Korea

Related clusters

To see the related clusters, click here.

DUBNIUM

DUBNIUM (which shares indicators with what Kaspersky researchers have called DarkHotel) is one of the activity groups that has been very active in recent years, and has many distinctive features.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DUBNIUM.

Known Synonyms
darkhotel

Internal MISP references

UUID b56af6ab-69f8-457a-bf50-c3aefa6dc14a which can be used as unique global reference for DUBNIUM in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/ - webarchive
• https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2 - webarchive
• https://blogs.technet.microsoft.com/mmpc/2016/06/20/reverse-engineering-dubniums-flash-targeting-exploit/ - webarchive
• https://blogs.technet.microsoft.com/mmpc/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Emerald Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emerald Sleet.

Known Synonyms
Black Banshee
Greendinosa
Kimsuky
RGB-D5
THALLIUM
Velvet Chollima

Internal MISP references

UUID 44be06b1-e17a-5ea6-a0a2-067933a7af77 which can be used as unique global reference for Emerald Sleet in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea
sector	North Korea

Related clusters

To see the related clusters, click here.

Fallow Squall

Microsoft threat actor profile. Origin/Threat: Singapore.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fallow Squall.

Known Synonyms
GINGERSNAP
PARASITE
PLATINUM
RUBYVINE

Internal MISP references

UUID 6d0809db-12c3-5193-ad5b-33dbb98fe379 which can be used as unique global reference for Fallow Squall in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	SG
microsoft-origin-threat	Singapore

Flax Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Flax Typhoon.

Known Synonyms
ETHEREAL PANDA
Storm-0919

Internal MISP references

UUID fd257ab6-5245-52c1-a456-7138d72112ac which can be used as unique global reference for Flax Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Forest Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Forest Blizzard.

Known Synonyms
APT28
ATG2
Blue Athena
CrisisFour
Fancy Bear
HELLFIRE
Operation Pawn Storm
STRONTIUM
Sednit
Sofacy
Tsar Team
Z-Lom Team

Internal MISP references

UUID 8d84d7b0-7716-5ab3-a3a4-f373dd148347 which can be used as unique global reference for Forest Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

GADOLINIUM

GADOLINIUM is a nation-state activity group that has been compromising targets for nearly a decade with a worldwide focus on the maritime and health industries. As with most threat groups, GADOLINIUM tracks the tools and techniques of security practitioners looking for new techniques they can use or modify to create new exploit methods. Historically, GADOLINIUM used custom-crafted malware families that analysts can identify and defend against. In response, over the last year GADOLINIUM has begun to modify portions of its toolchain to use open-source toolkits to obfuscate their activity and make it more difficult for analysts to track. Because cloud services frequently offer a free trial or one-time payment (PayGo) account offerings, malicious actors have found ways to take advantage of these legitimate business offerings. By establishing free or PayGo accounts, they can use cloud-based technology to create a malicious infrastructure that can be established quickly then taken down before detection or given up at little cost.

Internal MISP references

UUID 99e708f7-1c01-467d-b0da-f6cebd434abc which can be used as unique global reference for GADOLINIUM in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2020/09/24/gadolinium-detecting-empires-cloud/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GALLIUM

Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers. When Microsoft customers have been targeted by this activity, we notified them directly with the relevant information they need to protect themselves. By sharing the detailed methodology and indicators related to GALLIUM activity, we’re encouraging the security community to implement active defenses to secure the broader ecosystem from these attacks. To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss. Once persistence is established in a network, GALLIUM uses common techniques and tools like Mimikatz to obtain credentials that allows for lateral movement across the target network. Within compromised networks, GALLIUM makes no attempt to obfuscate their intent and are known to use common versions of malware and publicly available toolkits with small modifications. The operators rely on low cost and easy to replace infrastructure that consists of dynamic-DNS domains and regularly reused hop points. This activity from GALLIUM has been identified predominantly through 2018 to mid-2019. GALLIUM is still active; however, activity levels have dropped when compared to what was previously observed.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GALLIUM.

Known Synonyms
Operation Soft Cell

Internal MISP references

UUID 6085aad0-1d95-11ea-a140-078d42aced40 which can be used as unique global reference for GALLIUM in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Ghost Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ghost Blizzard.

Known Synonyms
BERSERK BEAR
BROMINE
Blue Kraken
Crouching Yeti
Dragonfly
Energetic Bear
Koala Team
TG-4192

Internal MISP references

UUID 45d0f984-2b63-517b-922a-12924bcf4f68 which can be used as unique global reference for Ghost Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

Gingham Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gingham Typhoon.

Known Synonyms
APT40
Feverdream
GADOLINIUM
JJDoor
Kryptonite Panda
Leviathan
TEMP.Periscope

Internal MISP references

UUID dbc45b46-5b64-50d4-b0f1-d7de888d4e85 which can be used as unique global reference for Gingham Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Granite Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Granite Typhoon.

Known Synonyms
GALLIUM
PHANTOM PANDA

Internal MISP references

UUID ae4036de-c901-5f21-808a-f5c071ef509b which can be used as unique global reference for Granite Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Gray Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gray Sandstorm.

Known Synonyms
DEV-0343

Internal MISP references

UUID 395473c6-be98-5369-82d1-cdbc97b3fddc which can be used as unique global reference for Gray Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

HAFNIUM

HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA. In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments. HAFNIUM operates primarily from leased virtual private servers (VPS) in the United States.

Internal MISP references

UUID fbb66d6c-0faa-49cc-8aa3-2f9bd4e9c298 which can be used as unique global reference for HAFNIUM in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Hazel Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hazel Sandstorm.

Known Synonyms
APT34
Cobalt Gypsy
Crambus
EUROPIUM
HELIX KITTEN
OilRig

Internal MISP references

UUID b6260d6d-a2f7-5b79-8132-5c456a225f53 which can be used as unique global reference for Hazel Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Related clusters

To see the related clusters, click here.

Heart Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Heart Typhoon.

Known Synonyms
APT17
ATG3
AURORA PANDA
DeputyDog
HELIUM
Hidden Lynx
KAOS
Red Typhoon
SportsFans
TG-8153
Tailgater

Internal MISP references

UUID a418d583-d520-5207-bec9-b634417d7f41 which can be used as unique global reference for Heart Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Hexagon Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hexagon Typhoon.

Known Synonyms
APT12
Calc Team
DNS-Calc
HORDE
HYDROGEN
NUMBERED PANDA
Red Anubis

Internal MISP references

UUID a8df4364-1b52-5cee-b103-da42fa640ddc which can be used as unique global reference for Hexagon Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Houndstooth Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Houndstooth Typhoon.

Known Synonyms
DRAGNET PANDA
HASSIUM
deepclif
isoon

Internal MISP references

UUID 7f875c7f-8209-5faa-877e-c0b5708d1a70 which can be used as unique global reference for Houndstooth Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Jade Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jade Sleet.

Known Synonyms
LABYRINTH CHOLLIMA
Storm-0954

Internal MISP references

UUID 67df1658-fa43-5cd0-9234-7ff2b86c2a8b which can be used as unique global reference for Jade Sleet in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea

Jasper Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jasper Sleet.

Known Synonyms
Storm-0287

Internal MISP references

UUID c7b33217-b9d9-538d-8947-63dc0d89e9dc which can be used as unique global reference for Jasper Sleet in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea

Lace Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lace Tempest.

Known Synonyms
DEV-0950
FIN11
TA505

Internal MISP references

UUID b27dcdee-14b1-5842-86b3-32eacec94584 which can be used as unique global reference for Lace Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated
sector	Financially motivated

Related clusters

To see the related clusters, click here.

LEAD

In contrast, LEAD has established a far greater reputation for industrial espionage. In the past few years, LEAD’s victims have included: Multinational, multi-industry companies involved in the manufacture of textiles, chemicals, and electronics Pharmaceutical companies A company in the chemical industry University faculty specializing in aeronautical engineering and research A company involved in the design and manufacture of motor vehicles A cybersecurity company focusing on protecting industrial control systems During these intrusions, LEAD’s objective was to steal sensitive data, including research materials, process documents, and project plans. LEAD also steals code-signing certificates to sign its malware in subsequent attacks. In most cases, LEAD’s attacks do not feature any advanced exploit techniques. The group also does not make special effort to cultivate victims prior to an attack. Instead, the group often simply emails a Winnti installer to potential victims, relying on basic social engineering tactics to convince recipients to run the attached malware. In some other cases, LEAD gains access to a target by brute-forcing remote access login credentials, performing SQL injection, or exploiting unpatched web servers, and then they copy the Winnti installer directly to compromised machines.

Internal MISP references

UUID f542442e-ba0f-425d-b386-6c10351a468e which can be used as unique global reference for LEAD in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Lemon Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lemon Sandstorm.

Known Synonyms
Fox Kitten
PIONEER KITTEN
PioneerKitten
RUBIDIUM
UNC757

Internal MISP references

UUID 0757856a-1313-57d8-bb6c-f4c537e110da which can be used as unique global reference for Lemon Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Related clusters

To see the related clusters, click here.

Leopard Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Leopard Typhoon.

Known Synonyms
KAOS
LEAD
Mana
Red Diablo
TG-2633
TG-3279
WICKED PANDA
Winnti Group

Internal MISP references

UUID 7796ae6d-a7fe-5ec0-976d-badff57ac65b which can be used as unique global reference for Leopard Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Lilac Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lilac Typhoon.

Known Synonyms
DEV-0234

Internal MISP references

UUID aa45a89c-4c2b-5f6b-9a3d-51abccaa9623 which can be used as unique global reference for Lilac Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Linen Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Linen Typhoon.

Known Synonyms
APT27
BOWSER
EMISSARY PANDA
Hippo
IODINE
Lucky Mouse
Red Phoenix
TG-3390
UNC215
Wekby2

Internal MISP references

UUID 45dc2a46-f0b1-5b5c-bf32-57d160542800 which can be used as unique global reference for Linen Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Luna Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Internal MISP references

UUID 1a85f99d-4fe1-5e89-bc84-32710f64ff69 which can be used as unique global reference for Luna Tempest in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Magenta Dust

Microsoft threat actor profile. Origin/Threat: Türkiye.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Magenta Dust.

Known Synonyms
PROMETHIUM
SmallPity
StrongPity

Internal MISP references

UUID 0d0c07ff-2246-5f59-80c7-b3b743252a76 which can be used as unique global reference for Magenta Dust in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	TR
microsoft-origin-threat	Türkiye

Manatee Tempest

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Manatee Tempest.

Known Synonyms
DEV-0243
EvilCorp
Indrik Spider
UNC2165

Internal MISP references

UUID b19bc1a0-2489-56ae-aa61-ed147310363e which can be used as unique global reference for Manatee Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Mango Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mango Sandstorm.

Known Synonyms
MERCURY
MuddyWater
SeedWorm
Static Kitten
TEMP.Zagros

Internal MISP references

UUID da68ca6d-250f-50f1-a585-240475fdbb35 which can be used as unique global reference for Mango Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Related clusters

To see the related clusters, click here.

Marbled Dust

Microsoft threat actor profile. Origin/Threat: Türkiye.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Marbled Dust.

Known Synonyms
COSMIC WOLF
SILICON
Sea Turtle
UNC1326

Internal MISP references

UUID fc91881e-92c0-5a63-a0b9-b253958a594e which can be used as unique global reference for Marbled Dust in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	TR
microsoft-origin-threat	Türkiye
sector	Turkey

Related clusters

To see the related clusters, click here.

Marigold Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Marigold Sandstorm.

Known Synonyms
DEV-0500
DEV-500
Moses Staff
VENGEFUL KITTEN

Internal MISP references

UUID ef415059-e150-5324-877e-44b65ab022f5 which can be used as unique global reference for Marigold Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Related clusters

To see the related clusters, click here.

Midnight Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Midnight Blizzard.

Known Synonyms
APT29
Cozy Bear
NOBELIUM
UNC2452

Internal MISP references

UUID 31982812-c8bf-5e85-b0ba-0c64a7d05d20 which can be used as unique global reference for Midnight Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

Mint Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mint Sandstorm.

Known Synonyms
APT35
Charming Kitten
Newscaster
PHOSPHORUS
Parastoo

Internal MISP references

UUID 400cd1b8-52b7-5a5c-984f-9b4af35ea231 which can be used as unique global reference for Mint Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Related clusters

To see the related clusters, click here.

Moonstone Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Moonstone Sleet.

Known Synonyms
LABYRINTH CHOLLIMA
Storm-1789

Internal MISP references

UUID b1e94607-7211-585d-8197-73e7d9229400 which can be used as unique global reference for Moonstone Sleet in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea

Mulberry Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mulberry Typhoon.

Known Synonyms
APT5
ATG48
Auriga
Backdoor-DPD
Bottle
COVENANT
CYSERVICE
Keyhole Panda
MANGANESE
Red Horus
Red Naga
TABCTENG
TG-2754

Internal MISP references

UUID fa562b27-d3ff-5e7c-9079-c957eb01a0e0 which can be used as unique global reference for Mulberry Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Mustard Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mustard Tempest.

Known Synonyms
DEV-0206
INDRIK SPIDER
Purple Vallhund

Internal MISP references

UUID 1b1524f4-16b0-5b85-aea4-844babea4ccb which can be used as unique global reference for Mustard Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated
sector	Financially motivated

NEODYMIUM

NEODYMIUM is an activity group that is known to use a backdoor malware detected by Microsoft as Wingbird. This backdoor’s characteristics closely match FinFisher, a government-grade commercial surveillance package. Data about Wingbird activity indicate that it is typically used to attack individual computers instead of networks.

Internal MISP references

UUID 47b5007a-3fb1-466a-9578-629e6e735493 which can be used as unique global reference for NEODYMIUM in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Neva Flood

Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Neva Flood.

Known Synonyms
CopyCop
Storm-1516

Internal MISP references

UUID 50ad9a39-a0c3-5ade-af96-fb57ea465bd5 which can be used as unique global reference for Neva Flood in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia, Influence operations

Night Tsunami

Microsoft threat actor profile. Origin/Threat: Israel.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Night Tsunami.

Known Synonyms
DEV-0336
NSO Group

Internal MISP references

UUID af54315b-3561-5046-8b9b-c3e9e05c0f77 which can be used as unique global reference for Night Tsunami in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IL
microsoft-origin-threat	Israel
sector	Private sector offensive actor

NOBELIUM

Threat actor behind the attacks against SolarWinds, the SUNBURST backdoor, TEARDROP malware, GoldMax malware.

Internal MISP references

UUID d7247cf9-13b6-4781-b789-a5f33521633b which can be used as unique global reference for NOBELIUM in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - webarchive
• https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Nylon Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Nylon Typhoon.

Known Synonyms
APT15
Mirage
NICKEL
Playful Dragon
RedRiver
Vixen Panda
ke3chang

Internal MISP references

UUID 66571167-13fe-5817-93e0-54ae8f206fdc which can be used as unique global reference for Nylon Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Octo Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Octo Tempest.

Known Synonyms
0ktapus
SCATTERED SPIDER

Internal MISP references

UUID 565b1ffa-6aa0-534d-a7bd-82ae942dd813 which can be used as unique global reference for Octo Tempest in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Oka Flood

Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Oka Flood.

Known Synonyms
Storm-1679

Internal MISP references

UUID 3f0694c2-605d-5ac3-bdd2-09c2d4be3d73 which can be used as unique global reference for Oka Flood in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia, Influence operations

Onyx Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Onyx Sleet.

Known Synonyms
APT45
Andariel
Black Chollima
DarkSeoul
PLUTONIUM
SILENT CHOLLIMA
StoneFly
Tdrop2 campaign

Internal MISP references

UUID 26a2854b-51e4-5fc9-8c30-2880d1483ed1 which can be used as unique global reference for Onyx Sleet in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea

Opal Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Opal Sleet.

Known Synonyms
APT43
Konni
OSMIUM
Planedown
VELVET CHOLLIMA

Internal MISP references

UUID 5163b2d9-7521-5225-a7a8-88d881fbc406 which can be used as unique global reference for Opal Sleet in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea
sector	North Korea

PARINACOTA

One actor that has emerged in this trend of human-operated attacks is an active, highly adaptive group that frequently drops Wadhrama as payload. PARINACOTA impacts three to four organizations every week and appears quite resourceful: during the 18 months that we have been monitoring it, we have observed the group change tactics to match its needs and use compromised machines for various purposes, including cryptocurrency mining, sending spam emails, or proxying for other attacks. The group’s goals and payloads have shifted over time, influenced by the type of compromised infrastructure, but in recent months, they have mostly deployed the Wadhrama ransomware. The group most often employs a smash-and-grab method, whereby they attempt to infiltrate a machine in a network and proceed with subsequent ransom in less than an hour. There are outlier campaigns in which they attempt reconnaissance and lateral movement, typically when they land on a machine and network that allows them to quickly and easily move throughout the environment. PARINACOTA’s attacks typically brute forces their way into servers that have Remote Desktop Protocol (RDP) exposed to the internet, with the goal of moving laterally inside a network or performing further brute-force activities against targets outside the network. This allows the group to expand compromised infrastructure under their control. Frequently, the group targets built-in local administrator accounts or a list of common account names. In other instances, the group targets Active Directory (AD) accounts that they compromised or have prior knowledge of, such as service accounts of known vendors. The group adopted the RDP brute force technique that the older ransomware called Samas (also known as SamSam) infamously used. Other malware families like GandCrab, MegaCortext, LockerGoga, Hermes, and RobbinHood have also used this method in targeted ransomware attacks. PARINACOTA, however, has also been observed to adapt to any path of least resistance they can utilize. For instance, they sometimes discover unpatched systems and use disclosed vulnerabilities to gain initial access or elevate privileges.

Internal MISP references

UUID 00edb40d-2fed-4d36-98b1-c85fc2bb1168 which can be used as unique global reference for PARINACOTA in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Patched Lightning

Microsoft threat actor profile from the public naming mapping feed.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Patched Lightning.

Known Synonyms
Storm-0113

Internal MISP references

UUID aac2327b-d330-55a0-8ead-d20df7413a56 which can be used as unique global reference for Patched Lightning in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value

Peach Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Peach Sandstorm.

Known Synonyms
APT33
Elfin
HOLMIUM
Refined Kitten

Internal MISP references

UUID 4c0f085a-70b1-5ee6-a45a-dc368f03e701 which can be used as unique global reference for Peach Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Related clusters

To see the related clusters, click here.

Pearl Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pearl Sleet.

Known Synonyms
DEV-0215
LAWRENCIUM

Internal MISP references

UUID 1c5c67ad-c241-5103-99d0-daab5a554b0d which can be used as unique global reference for Pearl Sleet in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea
sector	North Korea

Pepper Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pepper Typhoon.

Known Synonyms
CL-STA-0969
LIMINAL PANDA

Internal MISP references

UUID dfdd0ccd-9755-5988-8b23-595d0188608f which can be used as unique global reference for Pepper Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Periwinkle Tempest

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Periwinkle Tempest.

Known Synonyms
DEV-0193
UNC2053
Wizard Spider

Internal MISP references

UUID 120dc1ae-e850-5059-a4fb-520748ca6881 which can be used as unique global reference for Periwinkle Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Phlox Tempest

Microsoft threat actor profile. Origin/Threat: Israel, Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Phlox Tempest.

Known Synonyms
Choziosi loader
Chrome Loader
ClickPirate
DEV-0796

Internal MISP references

UUID 3c9a0350-8d17-5624-872c-fe44969a5888 which can be used as unique global reference for Phlox Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IL
microsoft-origin-threat	Israel, Financially motivated
sector	Financially motivated

Pink Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pink Sandstorm.

Known Synonyms
AMERICIUM
Agrius
BlackShadow
DEV-0227
Deadwood
FireAnt
Justice Blade
SPECTRAL KITTEN
SharpBoys

Internal MISP references

UUID cca311c0-dc91-5aee-b282-5e412040dac3 which can be used as unique global reference for Pink Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Pinstripe Lightning

Microsoft threat actor profile from the public naming mapping feed.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pinstripe Lightning.

Known Synonyms
Arid Viper
Desert Falcons
NIOBIUM
RENEGADE JACKAL
Scimitar

Internal MISP references

UUID 21d4413c-47f5-55c5-8074-aef6212c88ec which can be used as unique global reference for Pinstripe Lightning in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value

Pistachio Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pistachio Tempest.

Known Synonyms
DEV-0237
FIN12

Internal MISP references

UUID 567ea386-a78f-5550-ae7c-9c9eacdf45af which can be used as unique global reference for Pistachio Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Plaid Rain

Microsoft threat actor profile. Origin/Threat: Lebanon.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Plaid Rain.

Known Synonyms
INCENDIARY JACKAL
POLONIUM

Internal MISP references

UUID ce5357da-0e15-5022-bd4f-74aa689d0b2e which can be used as unique global reference for Plaid Rain in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	LB
microsoft-origin-threat	Lebanon
sector	Lebanon

Related clusters

To see the related clusters, click here.

PLATINUM

PLATINUM has been targeting its victims since at least as early as 2009, and may have been active for several years prior. Its activities are distinctly different not only from those typically seen in untargeted attacks, but from many targeted attacks as well. A large share of targeted attacks can be characterized as opportunistic: the activity group changes its target profiles and attack geographies based on geopolitical seasons, and may attack institutions all over the world. Like many such groups, PLATINUM seeks to steal sensitive intellectual property related to government interests, but its range of preferred targets is consistently limited to specific governmental organizations, defense institutes, intelligence agencies, diplomatic institutions, and telecommunication providers in South and Southeast Asia. The group’s persistent use of spear phishing tactics (phishing attempts aimed at specific individuals) and access to previously undiscovered zero-day exploits have made it a highly resilient threat.

Internal MISP references

UUID 154e97b5-47ef-415a-99a6-2157f1b50339 which can be used as unique global reference for PLATINUM in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/ - webarchive
• http://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PROMETHIUM

PROMETHIUM is an activity group that has been active as early as 2012. The group primarily uses Truvasys, a first-stage malware that has been in circulation for several years. Truvasys has been involved in several attack campaigns, where it has masqueraded as one of server common computer utilities, including WinUtils, TrueCrypt, WinRAR, or SanDisk. In each of the campaigns, Truvasys malware evolved with additional features—this shows a close relationship between the activity groups behind the campaigns and the developers of the malware.

Internal MISP references

UUID 5744f91a-d2d8-4f92-920f-943dd80c578f which can be used as unique global reference for PROMETHIUM in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2016/12/14/twin-zero-day-attacks-promethium-and-neodymium-target-individuals-in-europe/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Pumpkin Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pumpkin Sandstorm.

Known Synonyms
DEV-0146
ZeroCleare

Internal MISP references

UUID 562049d7-78f5-5a65-b7db-c509c9f483f7 which can be used as unique global reference for Pumpkin Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Purple Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Purple Typhoon.

Known Synonyms
AEON
APT10
ChChes
Evilgrab
Foxmail
Foxtrot
GOLEM
Haymaker
LIVESAFE
MenuPass
POTASSIUM
Red Apollo
STONE PANDA
Webmonder

Internal MISP references

UUID 2a3bd953-67fc-5966-a333-2c954522dec4 which can be used as unique global reference for Purple Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Raspberry Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Raspberry Typhoon.

Known Synonyms
APT30
LOTUS PANDA
LotusBlossom
RADIUM

Internal MISP references

UUID b3c378fc-1ce3-5a46-a32e-f55a584c6536 which can be used as unique global reference for Raspberry Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Red Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Red Sandstorm.

Known Synonyms
BANISHED KITTEN
Storm-0842
Void Manticore

Internal MISP references

UUID 46db3943-9a37-5f2b-8238-5b768934785e which can be used as unique global reference for Red Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran

Ruby Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ruby Sleet.

Known Synonyms
CERIUM
VELVET CHOLLIMA

Internal MISP references

UUID c29e7262-6a6f-501d-8c00-57f75f2172a3 which can be used as unique global reference for Ruby Sleet in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea
sector	North Korea

Ruza Flood

Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.

Internal MISP references

UUID bf33d93e-070c-5e0f-87b6-7bd25c881155 which can be used as unique global reference for Ruza Flood in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia, Influence operations

Salmon Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Salmon Typhoon.

Known Synonyms
APT4
MAVERICK PANDA
SODIUM

Internal MISP references

UUID 6da413e3-a027-5616-af21-0702f67ae972 which can be used as unique global reference for Salmon Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Salt Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Salt Typhoon.

Known Synonyms
FamousSparrow
GhostEmperor
OPERATOR PANDA

Internal MISP references

UUID 3b357ed0-c50c-5793-b0e9-e60ada7a50e5 which can be used as unique global reference for Salt Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Sangria Tempest

Microsoft threat actor profile. Origin/Threat: Ukraine, Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sangria Tempest.

Known Synonyms
Carbon Spider
ELBRUS
FIN7

Internal MISP references

UUID 9471ad21-0553-5483-bf7c-e6ad9c062c79 which can be used as unique global reference for Sangria Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	UA
microsoft-origin-threat	Ukraine, Financially motivated
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Sapphire Sleet

Microsoft threat actor profile. Origin/Threat: North Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sapphire Sleet.

Known Synonyms
Alluring Pisces
BlueNoroff
COPERNICIUM
CageyChameleon
CryptoCore
Genie Spider
STARDUST CHOLLIMA
UNC1069

Internal MISP references

UUID 3a32c54d-d86a-55de-b16a-d9a08a5cf49b which can be used as unique global reference for Sapphire Sleet in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KP
microsoft-origin-threat	North Korea
sector	North Korea

Related clusters

To see the related clusters, click here.

Satin Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Satin Typhoon.

Known Synonyms
APT18
COMBINE
DYNAMITE PANDA
Elderwood Group
Red Wraith
SCANDIUM
SILVERVIPER
TG-0416
Wekby

Internal MISP references

UUID 073df49d-f3c8-5459-b8d8-89e7beb348ef which can be used as unique global reference for Satin Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Seashell Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Seashell Blizzard.

Known Synonyms
APT44
BE2
BlackEnergy Lite
Blue Echidna
IRIDIUM
PHANTOM
Sandworm
UAC-0113
VOODOO BEAR

Internal MISP references

UUID 473eb51c-36cb-5e3a-8347-2f57df809be9 which can be used as unique global reference for Seashell Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

Secret Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Secret Blizzard.

Known Synonyms
ATG26
Blue Python
KRYPTON
Snake
Turla
Uroburos
Venomous Bear
WRAITH

Internal MISP references

UUID 8d19da8a-d0fa-5194-ad6f-315cc4f36c8b which can be used as unique global reference for Secret Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

Sefid Flood

Microsoft threat actor profile. Origin/Threat: Iran, Influence operations.

Internal MISP references

UUID 61f350a3-6507-5045-a3ef-0a5f773c9fe0 which can be used as unique global reference for Sefid Flood in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran, Influence operations

Shadow Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Shadow Typhoon.

Known Synonyms
DarkShadow
Oro0lxy
Storm-0062

Internal MISP references

UUID 4349a6d9-7838-57dc-9873-ddd5835ae428 which can be used as unique global reference for Shadow Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Silk Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Silk Typhoon.

Known Synonyms
HAFNIUM
MURKY PANDA
timmy

Internal MISP references

UUID 9728610a-17cb-5cac-9322-ef19ae296a29 which can be used as unique global reference for Silk Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Smoke Sandstorm

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Smoke Sandstorm.

Known Synonyms
BOHRIUM
IMPERIAL KITTEN
UNC1549

Internal MISP references

UUID 4426d375-1435-5ccc-8c1f-f8688bd11f80 which can be used as unique global reference for Smoke Sandstorm in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran
sector	Iran

Spandex Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Spandex Tempest.

Known Synonyms
CHIMBORAZO
MONTY SPIDER
TA505

Internal MISP references

UUID c85120d0-c397-5d30-9d57-3b019090acd5 which can be used as unique global reference for Spandex Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Star Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Star Blizzard.

Known Synonyms
BlueCharlie
COLDRIVER
Callisto
Callisto Group
Reuse Team
SEABORGIUM
TA446

Internal MISP references

UUID 06630ccd-98ed-5aec-8083-e04c894bd2d6 which can be used as unique global reference for Star Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia
sector	Russia

Related clusters

To see the related clusters, click here.

Storm-0133

Microsoft threat actor profile. Origin/Threat: Iran.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0133.

Known Synonyms
HEXANE
Lyceum
Siamesekitten
Spirlin

Internal MISP references

UUID dd5654f6-4ea2-53d9-bdd7-4e4e1d07dd86 which can be used as unique global reference for Storm-0133 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran

Storm-0156

Microsoft threat actor profile. Origin/Threat: Pakistan.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0156.

Known Synonyms
APT36
MYTHIC LEOPARD
SideCopy
Transparent Tribe

Internal MISP references

UUID 5df61c0b-9a22-5125-a9a6-048acca641a4 which can be used as unique global reference for Storm-0156 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	PK
microsoft-origin-threat	Pakistan

Storm-0216

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0216.

Known Synonyms
TUNNEL SPIDER
UNC2198

Internal MISP references

UUID 4435483b-a130-5d25-96f2-3625ed1d02b5 which can be used as unique global reference for Storm-0216 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-0230

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0230.

Known Synonyms
Conti Team 1
WIZARD SPIDER

Internal MISP references

UUID 7d9a8d61-6863-5c80-941d-840a1de3a944 which can be used as unique global reference for Storm-0230 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0247

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0247.

Known Synonyms
ToddyCat
Websiic

Internal MISP references

UUID 7a81f6b8-1e7f-5f28-8f69-8267bec40406 which can be used as unique global reference for Storm-0247 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Storm-0249

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID fc30a605-a6af-5f02-b93d-e2c352370cb3 which can be used as unique global reference for Storm-0249 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0252

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0252.

Known Synonyms
CHATTY SPIDER

Internal MISP references

UUID 303e4e4f-4ae5-52aa-9f17-0dd0f7f99223 which can be used as unique global reference for Storm-0252 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0257

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0257.

Known Synonyms
DEV-0257
UNC1151

Internal MISP references

UUID 60ac9e2c-b3b2-5c6b-913e-935952e14c28 which can be used as unique global reference for Storm-0257 in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive

Associated metadata

Metadata key	Value
sector	Group in development

Related clusters

To see the related clusters, click here.

Storm-0259

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 2c858cc8-fb74-5e4e-a92d-e57471bba3a1 which can be used as unique global reference for Storm-0259 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0288

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0288.

Known Synonyms
FIN8

Internal MISP references

UUID 6671d8ae-7856-595e-8b84-680c02131493 which can be used as unique global reference for Storm-0288 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0302

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0302.

Known Synonyms
NARWHAL SPIDER
TA544

Internal MISP references

UUID 71761cb6-1046-574b-a438-2dbc32733503 which can be used as unique global reference for Storm-0302 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0408

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 24435633-bfd9-58e8-8199-ad37d46d6b59 which can be used as unique global reference for Storm-0408 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0485

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 6541e7b1-c2bb-575e-90f1-49305625c17b which can be used as unique global reference for Storm-0485 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0501

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Internal MISP references

UUID 559c8dc4-1022-50ed-9f1c-d7715737fd87 which can be used as unique global reference for Storm-0501 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-0530

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0530.

Known Synonyms
DEV-0530
H0lyGh0st

Internal MISP references

UUID ab314f1c-8d07-5edb-bb32-64d1105f74ff which can be used as unique global reference for Storm-0530 in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive

Associated metadata

Metadata key	Value
country	KP
sector	North Korea

Storm-0538

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0538.

Known Synonyms
FIN6
SKELETON SPIDER

Internal MISP references

UUID 8ad930d9-fcdb-531b-827f-c4a05c36e152 which can be used as unique global reference for Storm-0538 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0539

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Internal MISP references

UUID b5678bd7-4ec0-51c0-8371-0846cc558e98 which can be used as unique global reference for Storm-0539 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-0569

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Internal MISP references

UUID d7bd75a2-15e3-5293-a53a-5a467326f5de which can be used as unique global reference for Storm-0569 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-0593

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0593.

Known Synonyms
InvisiMole

Internal MISP references

UUID 44bd7d68-2522-55b2-86ee-d1f74fe95281 which can be used as unique global reference for Storm-0593 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia

Storm-0671

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0671.

Known Synonyms
Tropicalscorpius
UNC2596

Internal MISP references

UUID d4c3823c-1535-597b-8e7d-784612ade7aa which can be used as unique global reference for Storm-0671 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-0940

Microsoft threat actor profile. Origin/Threat: China.

Internal MISP references

UUID c83eb0f5-eaff-5b3b-b938-4f9068255bf7 which can be used as unique global reference for Storm-0940 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Storm-0978

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-0978.

Known Synonyms
RomCom
Underground Team

Internal MISP references

UUID b2e3b39d-3988-530d-be21-ccc4f31f0caa which can be used as unique global reference for Storm-0978 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia

Storm-1101

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 69b69079-ccb0-5d6a-a69c-86b5c4fae168 which can be used as unique global reference for Storm-1101 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-1113

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-1113.

Known Synonyms
APOTHECARY SPIDER

Internal MISP references

UUID 669b24db-d543-560a-851a-5ba81a586350 which can be used as unique global reference for Storm-1113 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-1125

Microsoft threat actor profile. Origin/Threat: Belarus.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-1125.

Known Synonyms
MoustachedBouncer

Internal MISP references

UUID c373a2a3-f80d-515f-b1d8-13595c47de11 which can be used as unique global reference for Storm-1125 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	BY
microsoft-origin-threat	Belarus

Storm-1152

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Internal MISP references

UUID d9d23fe2-8efb-51cf-8913-91ed75f9379e which can be used as unique global reference for Storm-1152 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-1175

Microsoft threat actor profile. Origin/Threat: China, Financially motivated.

Internal MISP references

UUID fdb4a217-6ea3-58bd-b0af-35c01ebb5cad which can be used as unique global reference for Storm-1175 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China, Financially motivated

Storm-1194

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-1194.

Known Synonyms
MONTI

Internal MISP references

UUID 45b05a13-80ac-5f99-82a0-7c0bc41bc38a which can be used as unique global reference for Storm-1194 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-1249

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 3fc0b642-a037-5165-9e4b-c64e8f9593e2 which can be used as unique global reference for Storm-1249 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-1516

Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.

Internal MISP references

UUID 8b3ef1b4-c68d-56b8-8767-a2c293f4a65e which can be used as unique global reference for Storm-1516 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia, Influence operations

Storm-1567

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-1567.

Known Synonyms
PUNK SPIDER

Internal MISP references

UUID ba96d568-f803-50c9-907b-d11947123257 which can be used as unique global reference for Storm-1567 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-1575

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 567d3da5-d486-5f6c-a5f6-ed5cb4990ee2 which can be used as unique global reference for Storm-1575 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-1607

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID a90661e5-8b7a-5206-807f-aef8517aaf23 which can be used as unique global reference for Storm-1607 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-1674

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Internal MISP references

UUID 30ed08d3-db95-5d08-9504-9e9781a253d4 which can be used as unique global reference for Storm-1674 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-1747

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 317f8679-6add-5f53-9d60-a233bc860519 which can be used as unique global reference for Storm-1747 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-1811

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-1811.

Known Synonyms
CURLY SPIDER

Internal MISP references

UUID 6784f384-a942-5d7a-b693-4f8e383d54e0 which can be used as unique global reference for Storm-1811 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-1865

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID f0f9425a-f3ba-59ad-b1a7-41ec0bed10e3 which can be used as unique global reference for Storm-1865 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-1982

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-1982.

Known Synonyms
SneakyCheff
UNK_SweetSpecter

Internal MISP references

UUID 2df0d679-4402-54c9-8a04-af98861312a7 which can be used as unique global reference for Storm-1982 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Storm-2035

Microsoft threat actor profile. Origin/Threat: Iran, Influence operations.

Internal MISP references

UUID 67b75e8c-2a19-523f-ae3c-0e56fde9875b which can be used as unique global reference for Storm-2035 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	IR
microsoft-origin-threat	Iran, Influence operations

Storm-2077

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-2077.

Known Synonyms
TAG-100

Internal MISP references

UUID bb60789d-b159-53a7-b852-6f076380cf4e which can be used as unique global reference for Storm-2077 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Storm-2227

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 919c0184-9b73-55f5-9f70-f931155ac58c which can be used as unique global reference for Storm-2227 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-2372

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 35f8662a-f8a2-57b4-9ae2-df4d05e93b80 which can be used as unique global reference for Storm-2372 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-2460

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-2460.

Known Synonyms
Lumma Stealer

Internal MISP references

UUID d43caa08-f997-582f-ae95-c522dbc486a6 which can be used as unique global reference for Storm-2460 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-2470

Microsoft threat actor profile. Origin/Threat: China.

Internal MISP references

UUID 20935d1b-dafd-5373-bfd1-df8519507641 which can be used as unique global reference for Storm-2470 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Storm-2477

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID 1476ebb5-2336-53b0-a1c6-d23bab1497a8 which can be used as unique global reference for Storm-2477 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-2561

Microsoft threat actor profile. Origin/Threat: Group in development.

Internal MISP references

UUID fdaa6bfe-3b2a-5947-a6eb-71a12002719f which can be used as unique global reference for Storm-2561 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Storm-2603

Microsoft threat actor profile. Origin/Threat: China.

Internal MISP references

UUID afe95d2e-227c-59d3-918f-007163912e8f which can be used as unique global reference for Storm-2603 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Storm-2657

Microsoft threat actor profile. Origin/Threat: United States, Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-2657.

Known Synonyms
Payroll Pirates

Internal MISP references

UUID e7d96acd-a70c-5589-847f-1d6a8c6788ba which can be used as unique global reference for Storm-2657 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	United States, Financially motivated

Storm-2755

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Internal MISP references

UUID 5f98bdf4-a39c-5e99-ba2d-fc36c10c2b0c which can be used as unique global reference for Storm-2755 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Storm-2981

Microsoft threat actor profile. Origin/Threat: Group in development.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Storm-2981.

Known Synonyms
Coinbase Cartel

Internal MISP references

UUID 2dcf0edc-5cc9-5100-8e7b-11b5fa93b659 which can be used as unique global reference for Storm-2981 in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Group in development

Strawberry Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Strawberry Tempest.

Known Synonyms
DEV-0537
LAPSUS$
SLIPPY SPIDER

Internal MISP references

UUID d4dfb329-822c-5db3-a078-a8c0f77924da which can be used as unique global reference for Strawberry Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated
sector	Financially motivated

Related clusters

To see the related clusters, click here.

STRONTIUM

STRONTIUM has been active since at least 2007. Whereas most modern untargeted malware is ultimately profit-oriented, STRONTIUM mainly seeks sensitive information. Its primary institutional targets have included government bodies, diplomatic institutions, and military forces and installations in NATO member states and certain Eastern European countries. Additional targets have included journalists, political advisors, and organizations associated with political activism in central Asia. STRONTIUM is an activity group that usually targets government agencies, diplomatic institutions, and military organizations, as well as affiliated private sector organizations such as defense contractors and public policy research institutes. Microsoft has attributed more 0-day exploits to STRONTIUM than any other tracked group in 2016. STRONTIUM frequently uses compromised e-mail accounts from one victim to send malicious e-mails to a second victim and will persistently pursue specific targets for months until they are successful in compromising the victims’ computer.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular STRONTIUM.

Known Synonyms
APT 28
APT28
Fancy Bear
Grey-Cloud
Group-4127
Pawn Storm
Sednit
Sofacy
TG-4127
TsarTeam

Internal MISP references

UUID 213cdde9-c11a-4ea9-8ce0-c868e9826fec which can be used as unique global reference for STRONTIUM in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2016/11/01/our-commitment-to-our-customers-security/ - webarchive
• http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_A_Profile_Of_A_Persistent_Adversary_English.pdf - webarchive
• https://blogs.technet.microsoft.com/mmpc/2015/11/16/microsoft-security-intelligence-report-strontium/ - webarchive
• https://blogs.microsoft.com/on-the-issues/2018/08/20/we-are-taking-new-steps-against-broadening-threats-to-democracy/ - webarchive
• https://www.bleepingcomputer.com/news/security/microsoft-disrupts-apt28-hacking-campaign-aimed-at-us-midterm-elections/ - webarchive

Associated metadata

Metadata key	Value
country	RU

Related clusters

To see the related clusters, click here.

Sunglow Blizzard

Microsoft threat actor profile from the public naming mapping feed.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sunglow Blizzard.

Known Synonyms
DEV-0665

Internal MISP references

UUID 79f8646f-d127-51b7-b502-b096b445c322 which can be used as unique global reference for Sunglow Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
sector	Russia

Swirl Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Swirl Typhoon.

Known Synonyms
Bronze Butler
REDBALDKNIGHT
STALKER PANDA
TELLURIUM
Tick

Internal MISP references

UUID 655dd99e-fc7d-5f7b-88f0-796d6beb4857 which can be used as unique global reference for Swirl Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Taffeta Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Taffeta Typhoon.

Known Synonyms
APT26
BEARCLAW
JerseyMikes
Red Kobold
TECHNETIUM
TG-0055
TURBINE PANDA

Internal MISP references

UUID 31da9f81-56d4-5c95-87c3-ec4568cdfc2a which can be used as unique global reference for Taffeta Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Taizi Flood

Microsoft threat actor profile. Origin/Threat: China, Influence operations.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Taizi Flood.

Known Synonyms
Dragonbridge
Spamouflage

Internal MISP references

UUID f69bbe03-a0c5-5f59-ada9-e1b9f1beea0c which can be used as unique global reference for Taizi Flood in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China, Influence operations

TERBIUM

Microsoft Threat Intelligence identified similarities between this recent attack and previous 2012 attacks against tens of thousands of computers belonging to organizations in the energy sector. Microsoft Threat Intelligence refers to the activity group behind these attacks as TERBIUM, following our internal practice of assigning rogue actors chemical element names.

Internal MISP references

UUID 99784b80-6298-45ba-885c-0ed37bfd8324 which can be used as unique global reference for TERBIUM in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2016/12/09/windows-10-protection-detection-and-response-against-recent-attacks/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Tomato Tempest

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tomato Tempest.

Known Synonyms
SPURR
Vatet

Internal MISP references

UUID 028b667a-1102-5b1e-9726-edbf145d9d8f which can be used as unique global reference for Tomato Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive

Associated metadata

Metadata key	Value
sector	Financially motivated

Tumbleweed Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tumbleweed Typhoon.

Known Synonyms
Karst
THORIUM

Internal MISP references

UUID c58445b5-0c8c-5844-83ef-5c3a7176f0e1 which can be used as unique global reference for Tumbleweed Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Twill Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Twill Typhoon.

Known Synonyms
BRONZE PRESIDENT
LuminousMoth
MUSTANG PANDA
TANTALUM

Internal MISP references

UUID 4020ad2a-fa0e-56f2-a33a-bffb3b1717f6 which can be used as unique global reference for Twill Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Vanilla Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Vanilla Tempest.

Known Synonyms
DEV-0832
VICE SPIDER
Vice Society

Internal MISP references

UUID a01da064-988c-5ad3-92c6-9537adb6a5f0 which can be used as unique global reference for Vanilla Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated
sector	Financially motivated

Velvet Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Velvet Tempest.

Known Synonyms
ALPHA SPIDER
DEV-0504

Internal MISP references

UUID 0662a721-a92e-50b3-a5ac-0c4142ac9aeb which can be used as unique global reference for Velvet Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated
sector	Financially motivated

Violet Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Violet Typhoon.

Known Synonyms
APT31
Chameleon
JUDGMENT PANDA
WebFans
ZIRCONIUM

Internal MISP references

UUID 27eb4928-b3e6-5ae1-bbb6-f73bce8d7c69 which can be used as unique global reference for Violet Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China
sector	China

Related clusters

To see the related clusters, click here.

Void Blizzard

Microsoft threat actor profile. Origin/Threat: Russia.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Void Blizzard.

Known Synonyms
Laundry Bear

Internal MISP references

UUID 0bd1fd55-daef-51ad-82c5-4d79859f87d1 which can be used as unique global reference for Void Blizzard in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia

Volga Flood

Microsoft threat actor profile. Origin/Threat: Russia, Influence operations.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Volga Flood.

Known Synonyms
Rybar
Storm-1841

Internal MISP references

UUID 5efac1a3-ede6-53d5-88d5-6c650df36cab which can be used as unique global reference for Volga Flood in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	RU
microsoft-origin-threat	Russia, Influence operations

Volt Typhoon

Microsoft threat actor profile. Origin/Threat: China.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Volt Typhoon.

Known Synonyms
BRONZE SILHOUETTE
VANGUARD PANDA

Internal MISP references

UUID 7c4a32dc-24d5-5d69-96a2-9d0a2ae0f31b which can be used as unique global reference for Volt Typhoon in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China

Wheat Tempest

Microsoft threat actor profile. Origin/Threat: Financially motivated.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wheat Tempest.

Known Synonyms
GOLD
Gatak

Internal MISP references

UUID 9288268f-8511-5932-8a0c-f240c0799603 which can be used as unique global reference for Wheat Tempest in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	Financially motivated

Wine Tempest

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wine Tempest.

Known Synonyms
PARINACOTA
Wadhrama

Internal MISP references

UUID 5939e42e-06d0-5719-8072-62f0fc0821e8 which can be used as unique global reference for Wine Tempest in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive

Associated metadata

Metadata key	Value
sector	Financially motivated

Related clusters

To see the related clusters, click here.

Wisteria Tsunami

Microsoft threat actor profile. Origin/Threat: India, Private sector offensive actor.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wisteria Tsunami.

Known Synonyms
CyberRoot
DEV-0605
MintedSoil

Internal MISP references

UUID 2263b6c9-861a-5971-b882-9ea4a84fcf74 which can be used as unique global reference for Wisteria Tsunami in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
microsoft-origin-threat	India, Private sector offensive actor
sector	Private sector offensive actor

Yulong Flood

Microsoft threat actor profile. Origin/Threat: China, Influence operations.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yulong Flood.

Known Synonyms
Storm-1852

Internal MISP references

UUID 18e08038-d73d-5f35-9851-b226e499c438 which can be used as unique global reference for Yulong Flood in MISP communities and other software using the MISP galaxy

External references

• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	CN
microsoft-origin-threat	China, Influence operations

Zigzag Hail

Microsoft threat actor profile. Origin/Threat: Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zigzag Hail.

Known Synonyms
APT-C-60
DUBNIUM
Dark Hotel
Egobot
Fallout Team
Nemim
PALADIN
Purple Pygmy
SHADOW CRANE
TEMPLAR
Tapaoux
TieOnJoe

Internal MISP references

UUID 0a4ddab3-a1a6-5372-b11f-5edc25c0e548 which can be used as unique global reference for Zigzag Hail in MISP communities and other software using the MISP galaxy

External references

• https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide - webarchive
• https://raw.githubusercontent.com/microsoft/mstic/master/PublicFeeds/ThreatActorNaming/MicrosoftMapping.json - webarchive

Associated metadata

Metadata key	Value
country	KR
microsoft-origin-threat	Korea
sector	South Korea

Related clusters

To see the related clusters, click here.

ZIRCONIUM

In addition to strengthening generic detection of EoP exploits, Microsoft security researchers are actively gathering threat intelligence and indicators attributable to ZIRCONIUM, the activity group using the CVE-2017-0005 exploit.

Internal MISP references

UUID 2d19c573-252b-49d8-8c2e-3b529b91e72d which can be used as unique global reference for ZIRCONIUM in MISP communities and other software using the MISP galaxy

External references

• https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.