Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: add :targeted_{countries,industries} to Actor #447

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

frenchy64
Copy link
Contributor

@frenchy64 frenchy64 commented Jun 3, 2024

XDR-2098

@@ -39,7 +39,9 @@
:valid_time {:start_time #inst "2016-02-11T00:40:48.212-00:00"
:end_time #inst "2016-07-11T00:40:48.212-00:00"}
:tlp "green"
:aliases ["alias 1" "alias 2"]})
:aliases ["alias 1" "alias 2"]
:targeted_countries ["840"]
Copy link
Contributor

@michaels-den michaels-den Jun 17, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's us 3166-1 A2 codes, ie 2-letter country codes, see the following example:

  "[APT38](https://attack.mitre.org/groups/G0082) is a North Korean state-sponsored     
threat group that specializes in financial cyber operations; it has been attributed to  
the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020)     
Active since at least 2014, [APT38](https://attack.mitre.org/groups/G0082) has targeted 
banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system          
endpoints, and ATMs in at least 38 countries worldwide. Significant operations include  
the 2016 Bank of Bangladesh heist, during which                                         
[APT38](https://attack.mitre.org/groups/G0082) stole $81 million, as well as attacks    
against Bancomext (2018) and Banco de Chile (2018); some of their attacks have been     
destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38   
Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus    
Under The Hood Blog 2017)\n\nNorth Korean group definitions are known to have           
significant overlap, and some security researchers report all North Korean              
state-sponsored cyber activity under the name [Lazarus                                  
Group](https://attack.mitre.org/groups/G0032) instead of tracking clusters or           
subgroups.",                                                                            
  :aliases                                                                              
  ["APT38"                                                                              
   "NICKEL GLADSTONE"                                                                   
   "BeagleBoyz"                                                                         
   "Bluenoroff"                                                                         
   "Stardust Chollima"],                                                                
  :external_references                                                                  
  {:external_id "G0082",                                                                
   :source_name "mitre-attack",                                                         
   :url "https://attack.mitre.org/groups/G0082"},                                       
  :mitre_group_id "G0082",                                                              
  :targeted_industries ["financial-services", "government"]                             
  :targeted_countries ["BD", "MX", "CL"]}                             

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants