auren-research/cyber-sec huggingface dataset:
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c5947e1c-1cbc-434c-94b8-27c7e3be0fff
created: 2017-05-31T21:32:08.682Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0044
external_id: G0044
source_name: Winnti Group
description: (Citation: Kaspersky Winnti April 2013) (Citation: Kaspersky Winnti June 2015)
source_name: Blackfly
description: (Citation: Symantec Suckfly March 2016)
source_name: Symantec Suckfly March 2016
description: DiMaggio, J. (2016, March 15). Suckfly: Revealing the secret life of your code signing certificates. Retrieved August 3, 2016.
url: http://www.symantec.com/connect/blogs/suckfly-revealing-secret-life-your-code-signing-certificates
source_name: 401 TRG Winnti Umbrella May 2018
description: Hegel, T. (2018, May 3). Burning Umbrella: An Intelligence Report on the Winnti Umbrella and Associated State-Sponsored Attackers. Retrieved July 8, 2018.
url: https://401trg.github.io/pages/burning-umbrella.html
source_name: Kaspersky Winnti April 2013
description: Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.
url: https://securelist.com/winnti-more-than-just-a-game/37029/
source_name: Novetta Winnti April 2015
description: Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.
url: https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf
source_name: Kaspersky Winnti June 2015
description: Tarakanov, D. (2015, June 22). Games are over: Winnti is now targeting pharmaceutical companies. Retrieved January 14, 2016.
url: https://securelist.com/games-are-over/70991/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:35.689Z
name: Winnti Group
description: [Winnti Group](https://attack.mitre.org/groups/G0044) is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015) Some reporting suggests a number of other groups, including [Axiom](https://attack.mitre.org/groups/G0001), [APT17](https://attack.mitre.org/groups/G0025), and [Ke3chang](https://attack.mitre.org/groups/G0004), are closely linked to [Winnti Group](https://attack.mitre.org/groups/G0044).(Citation: 401 TRG Winnti Umbrella May 2018)
aliases: Winnti Group
Blackfly
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Edward Millington
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fd19bd82-1b14-49a1-a176-6cdc46b8a826
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0061
external_id: G0061
source_name: FIN8
description: (Citation: FireEye Obfuscation June 2017)
source_name: Syssphinx
description: (Citation: Symantec FIN8 Jul 2023)
source_name: FireEye Obfuscation June 2017
description: Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.
url: https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
source_name: Bitdefender Sardonic Aug 2021
description: Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
url: https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf
source_name: FireEye Fin8 May 2016
description: Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.
url: https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html
source_name: Symantec FIN8 Jul 2023
description: Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.
url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:35.846Z
name: FIN8
description: [FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)
aliases: FIN8
Syssphinx
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Daniyal Naeem, BT Security
Serhii Melnyk, Trustwave SpiderLabs
type: intrusion-set
spec_version: 2.1
id: intrusion-set--44102191-3a31-45f8-acbe-34bdb441d5ad
created: 2020-05-26T14:20:20.623Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0106
external_id: G0106
source_name: Talos Rocke August 2018
description: Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.
url: https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:08.821Z
name: Rocke
description: [Rocke](https://attack.mitre.org/groups/G0106) is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name [Rocke](https://attack.mitre.org/groups/G0106) comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between [Rocke](https://attack.mitre.org/groups/G0106) and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)
aliases: Rocke
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2025-03-13T20:54:46.475Z
name: RedEcho
description: [RedEcho](https://attack.mitre.org/groups/G1042) is a People’s Republic of China-related threat actor associated with long-running intrusions in Indian critical infrastructure entities. [RedEcho](https://attack.mitre.org/groups/G1042) overlaps with various other PRC-linked threat groups, such as [APT41](https://attack.mitre.org/groups/G0096), and is linked to [ShadowPad](https://attack.mitre.org/software/S0596) malware use through shared infrastructure.(Citation: RecordedFuture RedEcho 2021)(Citation: RecordedFuture RedEcho 2022)
aliases: RedEcho
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--2c40f629-6cf9-4f75-af32-9a98caec24ae
created: 2024-11-21T22:34:30.327Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1042
external_id: G1042
source_name: RecordedFuture RedEcho 2021
description: Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.
url: https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf
source_name: RecordedFuture RedEcho 2022
description: Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.
url: https://go.recordedfuture.com/hubfs/reports/ta-2022-0406.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-08-12T17:32:47.430Z
name: Saint Bear
description: [Saint Bear](https://attack.mitre.org/groups/G1031) is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, [Saint Bot](https://attack.mitre.org/software/S1018), and information stealer, [OutSteel](https://attack.mitre.org/software/S1017) in campaigns. [Saint Bear](https://attack.mitre.org/groups/G1031) typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )(Citation: Cadet Blizzard emerges as novel threat actor) [Saint Bear](https://attack.mitre.org/groups/G1031) has previously been confused with [Ember Bear](https://attack.mitre.org/groups/G1003) operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.
aliases: Saint Bear
Storm-0587
TA471
UAC-0056
Lorec53
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--674582ec-51c4-42ce-b409-797239e37a2a
created: 2024-05-25T16:11:54.881Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1031
external_id: G1031
source_name: Storm-0587
description: (Citation: Cadet Blizzard emerges as novel threat actor)
source_name: TA471
description: (Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
source_name: UAC-0056
description: (Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
source_name: Lorec53
description: (Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
source_name: Cadet Blizzard emerges as novel threat actor
description: Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.
url: https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/
source_name: Palo Alto Unit 42 OutSteel SaintBot February 2022 
description: Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
url: https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--4e868dad-682d-4897-b8df-2dc98f46c68a
created: 2021-02-10T19:57:38.042Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0124
external_id: G0124
source_name: ESET Windigo Mar 2014
description: Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021.
url: https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/
source_name: CERN Windigo June 2019
description: CERN. (2019, June 4). 2019/06/04 Advisory: Windigo attacks. Retrieved February 10, 2021.
url: https://security.web.cern.ch/advisories/windigo/windigo.shtml
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:09.909Z
name: Windigo
description: The [Windigo](https://attack.mitre.org/groups/G0124) group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the [Ebury](https://attack.mitre.org/software/S0377) SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, [Windigo](https://attack.mitre.org/groups/G0124) operators continued updating [Ebury](https://attack.mitre.org/software/S0377) through 2019.(Citation: ESET Windigo Mar 2014)(Citation: CERN Windigo June 2019)
aliases: Windigo
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-07-10T18:53:44.277Z
name: Blue Mockingbird
description: [Blue Mockingbird](https://attack.mitre.org/groups/G0108) is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)
aliases: Blue Mockingbird
x_mitre_deprecated: no
x_mitre_version: 1.3
x_mitre_contributors: Tony Lambert, Red Canary
type: intrusion-set
spec_version: 2.1
id: intrusion-set--73a80fab-2aa3-48e0-a4d0-3a4828200aee
created: 2020-05-26T20:09:39.139Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0108
external_id: G0108
source_name: RedCanary Mockingbird May 2020
description: Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
url: https://redcanary.com/blog/blue-mockingbird-cryptominer/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: campaign
spec_version: 2.1
id: campaign--35879bf3-0a21-4cc1-9e42-6de917a22501
created: 2025-06-24T15:14:52.789Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0056
external_id: C0056
source_name: Juniper RedPenguin MAR 2025
description: Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025.
url: https://supportportal.juniper.net/sfc/servlet.shepherd/document/download/069Dp00000FzdmIIAR?operationContext=S1
source_name: Mandiant UNC3886 Juniper Routers MAR 2025
description: Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025.
url: https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-targets-juniper-routers
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T03:46:34.675Z
name: RedPenguin
description: The [RedPenguin](https://attack.mitre.org/campaigns/C0056) project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. [RedPenguin](https://attack.mitre.org/campaigns/C0056) activity was separately attributed to [UNC3886](https://attack.mitre.org/groups/G1048) and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.(Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)
aliases: RedPenguin
first_seen: 2024-07-01T04:00:00.000Z
last_seen: 2025-03-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)
x_mitre_last_seen_citation: (Citation: Juniper RedPenguin MAR 2025)(Citation: Mandiant UNC3886 Juniper Routers MAR 2025)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_domains: enterprise-attack
modified: 2024-09-23T23:11:00.562Z
name: RedCurl
description: [RedCurl](https://attack.mitre.org/groups/G1039) is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including but not limited to travel agencies, insurance companies, and banks.(Citation: group-ib_redcurl1) [RedCurl](https://attack.mitre.org/groups/G1039) is allegedly a Russian-speaking threat actor.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2) The group’s operations typically start with spearphishing emails to gain initial access, then the group executes discovery and collection commands and scripts to find corporate data. The group concludes operations by exfiltrating files to the C2 servers. 
aliases: RedCurl
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Joe Gumke, U.S. Bank
type: intrusion-set
spec_version: 2.1
id: intrusion-set--82323c70-4186-4b61-94f5-b227c3b28e89
created: 2024-09-23T21:32:19.337Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1039
external_id: G1039
source_name: group-ib_redcurl1
description: Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.
url: https://www.group-ib.com/resources/research-hub/red-curl/
source_name: group-ib_redcurl2
description: Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.
url: https://www.group-ib.com/resources/research-hub/red-curl-2/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--bb82e0b0-6e9c-439f-970a-4c917a74c5f2
created: 2021-05-24T13:37:20.240Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0132
external_id: G0132
source_name: BlackBerry CostaRicto November 2020
description: The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.
url: https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:27.430Z
name: CostaRicto
description: [CostaRicto](https://attack.mitre.org/groups/G0132) is a suspected hacker-for-hire cyber espionage campaign that has targeted multiple industries worldwide since at least 2019. [CostaRicto](https://attack.mitre.org/groups/G0132)'s targets, a large portion of which are financial institutions, are scattered across Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia.(Citation: BlackBerry CostaRicto November 2020)
aliases: CostaRicto
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-11-17T15:57:47.485Z
name: FIN4
description: [FIN4](https://attack.mitre.org/groups/G0085) is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014) [FIN4](https://attack.mitre.org/groups/G0085) is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)
aliases: FIN4
x_mitre_deprecated: no
x_mitre_version: 1.2
type: intrusion-set
spec_version: 2.1
id: intrusion-set--d0b3393b-3bec-4ba3-bda9-199d30db47b6
created: 2019-01-31T02:01:45.129Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0085
external_id: G0085
source_name: FIN4
description: (Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)
source_name: FireEye FIN4 Stealing Insider NOV 2014
description: Dennesen, K. et al.. (2014, November 30). FIN4: Stealing Insider Information for an Advantage in Stock Trading?. Retrieved November 17, 2024.
url: https://web.archive.org/web/20190508171649/https://www.fireeye.com/blog/threat-research/2014/11/fin4_stealing_insid.html
source_name: FireEye Hacking FIN4 Video Dec 2014
description: Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.
url: https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html
source_name: FireEye Hacking FIN4 Dec 2014
description: Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.
url: https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-09-28T09:54:33.751Z
name: Versa Director Zero Day Exploitation
description: [Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) was conducted by [Volt Typhoon](https://attack.mitre.org/groups/G1017) from early June through August 2024 as zero-day exploitation of Versa Director servers controlling software-defined wide area network (SD-WAN) applications. Since tracked as CVE-2024-39717, exploitation focused on credential capture from compromised Versa Director servers at managed service providers (MSPs) and internet service providers (ISPs) to enable follow-on access to service provider clients. [Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) was followed by the delivery of the [VersaMem](https://attack.mitre.org/software/S1154) web shell for both credential theft and follow-on code execution.(Citation: Lumen Versa 2024)
aliases: Versa Director Zero Day Exploitation
first_seen: 2024-06-01T06:00:00.000Z
last_seen: 2024-08-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: Lumen Versa 2024)
x_mitre_last_seen_citation: (Citation: Lumen Versa 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--af0ec65a-caa9-40ef-b1c7-21b71fbf3a10
created: 2024-08-27T18:34:35.056Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0039
external_id: C0039
source_name: Lumen Versa 2024
description: Black Lotus Labs. (2024, August 27). Taking The Crossroads: The Versa Director Zero-Day Exploitaiton. Retrieved August 27, 2024.
url: https://blog.lumen.com/taking-the-crossroads-the-versa-director-zero-day-exploitation/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack