auren-research/cyber-sec huggingface dataset:
modified: 2024-04-11T00:29:32.199Z
name: Operation Spalax
description: [Operation Spalax](https://attack.mitre.org/campaigns/C0005) was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The [Operation Spalax](https://attack.mitre.org/campaigns/C0005) threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to [APT-C-36](https://attack.mitre.org/groups/G0099), however identified enough differences to report this as separate, unattributed activity.(Citation: ESET Operation Spalax Jan 2021) 
aliases: Operation Spalax
first_seen: 2019-11-01T05:00:00.000Z
last_seen: 2021-01-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: ESET Operation Spalax Jan 2021)
x_mitre_last_seen_citation: (Citation: ESET Operation Spalax Jan 2021)
x_mitre_deprecated: no
x_mitre_version: 1.1
type: campaign
spec_version: 2.1
id: campaign--4c840263-bbda-440d-a22b-674679ddebf1
created: 2022-09-16T15:32:41.893Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0005
external_id: C0005
source_name: ESET Operation Spalax Jan 2021
description: M. Porolli. (2021, January 21). Operation Spalax: Targeted malware attacks in Colombia. Retrieved September 16, 2022.
url: https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2024-04-11T16:06:34.700Z
name: APT33
description: [APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)
aliases: APT33
HOLMIUM
Elfin
Peach Sandstorm
x_mitre_deprecated: no
x_mitre_version: 2.0
x_mitre_contributors: Dragos Threat Intelligence
type: intrusion-set
spec_version: 2.1
id: intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0064
external_id: G0064
source_name: APT33
description: (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)
source_name: HOLMIUM
description: (Citation: Microsoft Holmium June 2020)
source_name: Peach Sandstorm
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Elfin
description: (Citation: Symantec Elfin Mar 2019)
source_name: FireEye APT33 Webinar Sept 2017
description: Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.
url: https://www.brighttalk.com/webcast/10703/275683
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft Holmium June 2020
description: Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020.
url: https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/
source_name: FireEye APT33 Sept 2017
description: O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
url: https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html
source_name: Symantec Elfin Mar 2019
description: Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
url: https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: campaign
spec_version: 2.1
id: campaign--37764c78-2a99-46d1-a7ea-6454b9bf93a0
created: 2022-09-26T21:18:34.075Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0013
external_id: C0013
source_name: Bleeping Computer Op Sharpshooter March 2019
description: I. Ilascu. (2019, March 3). Op 'Sharpshooter' Connected to North Korea's Lazarus Group. Retrieved September 26, 2022.
url: https://www.bleepingcomputer.com/news/security/op-sharpshooter-connected-to-north-koreas-lazarus-group/
source_name: Threatpost New Op Sharpshooter Data March 2019
description: L. O'Donnell. (2019, March 3). RSAC 2019: New Operation Sharpshooter Data Reveals Higher Complexity, Scope. Retrieved September 26, 2022.
url: https://threatpost.com/sharpshooter-complexity-scope/142359/
source_name: McAfee Sharpshooter December 2018
description: Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
url: https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:47.743Z
name: Operation Sharpshooter
description: [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, and the United States. Security researchers noted the campaign shared many similarities with previous [Lazarus Group](https://attack.mitre.org/groups/G0032) operations, including fake job recruitment lures and shared malware code.(Citation: McAfee Sharpshooter December 2018)(Citation: Bleeping Computer Op Sharpshooter March 2019)(Citation: Threatpost New Op Sharpshooter Data March 2019) 
aliases: Operation Sharpshooter
first_seen: 2017-09-01T05:00:00.000Z
last_seen: 2019-03-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: Threatpost New Op Sharpshooter Data March 2019)
x_mitre_last_seen_citation: (Citation: Threatpost New Op Sharpshooter Data March 2019)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c77c5576-ca19-42ed-a36f-4b4486a84133
created: 2020-09-22T19:41:27.845Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0115
external_id: G0115
source_name: Pinchy Spider
description: (Citation: CrowdStrike Evolution of Pinchy Spider July 2021)
source_name: Secureworks REvil September 2019
description: Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.
url: https://www.secureworks.com/research/revil-sodinokibi-ransomware
source_name: CrowdStrike Evolution of Pinchy Spider July 2021
description: Meyers, Adam. (2021, July 6). The Evolution of PINCHY SPIDER from GandCrab to REvil. Retrieved March 28, 2023.
url: https://www.crowdstrike.com/blog/the-evolution-of-revil-ransomware-and-pinchy-spider/
source_name: Secureworks GandCrab and REvil September 2019
description: Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.
url: https://www.secureworks.com/blog/revil-the-gandcrab-connection
source_name: Secureworks GOLD SOUTHFIELD
description: Secureworks. (n.d.). GOLD SOUTHFIELD. Retrieved October 6, 2020.
url: https://www.secureworks.com/research/threat-profiles/gold-southfield
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:38.397Z
name: GOLD SOUTHFIELD
description: [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) is a financially motivated threat group active since at least 2018 that operates the [REvil](https://attack.mitre.org/software/S0496) Ransomware-as-a Service (RaaS). [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)
aliases: GOLD SOUTHFIELD
Pinchy Spider
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Thijn Bukkems, Amazon
type: intrusion-set
spec_version: 2.1
id: intrusion-set--b2e34388-6938-4c59-a702-80dc219e15e3
created: 2021-02-08T20:30:30.578Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0123
external_id: G0123
source_name: Volatile Cedar
description: (Citation: CheckPoint Volatile Cedar March 2015)
source_name: Lebanese Cedar
description: (Citation: ClearSky Lebanese Cedar Jan 2021)
source_name: ClearSky Lebanese Cedar Jan 2021
description: ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.
url: https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf
source_name: CheckPoint Volatile Cedar March 2015
description: Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:38.546Z
name: Volatile Cedar
description: [Volatile Cedar](https://attack.mitre.org/groups/G0123) is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. [Volatile Cedar](https://attack.mitre.org/groups/G0123) has been operating since 2012 and is motivated by political and ideological interests.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)
aliases: Volatile Cedar
Lebanese Cedar
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--1f0f9a14-11aa-49aa-9174-bcd0eaa979de
created: 2021-01-22T16:46:17.790Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0120
external_id: G0120
source_name: Evilnum
description: (Citation: ESET EvilNum July 2020)
source_name: ESET EvilNum July 2020
description: Porolli, M. (2020, July 9). More evil: A deep look at Evilnum and its toolset. Retrieved January 22, 2021.
url: https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:26.766Z
name: Evilnum
description: [Evilnum](https://attack.mitre.org/groups/G0120) is a financially motivated threat group that has been active since at least 2018.(Citation: ESET EvilNum July 2020)
aliases: Evilnum
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--5e78ae92-3ffd-4b16-bf62-e798529d73f1
created: 2020-05-14T21:40:31.089Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0104
external_id: G0104
source_name: McAfee Sharpshooter December 2018
description: Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
url: https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T17:59:28.191Z
name: Sharpshooter
description: Operation [Sharpshooter](https://attack.mitre.org/groups/G0104) is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and [Lazarus Group](https://attack.mitre.org/groups/G0032) have been noted, definitive links have not been established.(Citation: McAfee Sharpshooter December 2018)
aliases: Sharpshooter
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--8f5e8dc7-739d-4f5e-a8a1-a66e004d7063
created: 2017-05-31T21:31:46.390Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0003
external_id: G0003
source_name: Cleaver
description: (Citation: Cylance Cleaver)
source_name: Threat Group 2889
description: (Citation: Dell Threat Group 2889)
source_name: TG-2889
description: (Citation: Dell Threat Group 2889)
source_name: Cylance Cleaver
description: Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.
url: https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf
source_name: Dell Threat Group 2889
description: Dell SecureWorks. (2015, October 7). Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles. Retrieved January 14, 2016.
url: http://www.secureworks.com/cyber-threat-intelligence/threats/suspected-iran-based-hacker-group-creates-network-of-fake-linkedin-profiles/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:38.869Z
name: Cleaver
description: [Cleaver](https://attack.mitre.org/groups/G0003) is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. (Citation: Cylance Cleaver) Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). (Citation: Dell Threat Group 2889)
aliases: Cleaver
Threat Group 2889
TG-2889
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
modified: 2024-04-17T16:13:43.697Z
name: TEMP.Veles
description: [TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)
aliases: TEMP.Veles
XENOTIME
x_mitre_deprecated: no
x_mitre_version: 1.4
x_mitre_contributors: Dragos Threat Intelligence
type: intrusion-set
spec_version: 2.1
id: intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4
created: 2019-04-16T15:14:38.533Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0088
external_id: G0088
source_name: TEMP.Veles
description: (Citation: FireEye TRITON 2019)
source_name: Dragos Xenotime 2018
description: Dragos, Inc.. (n.d.). Xenotime. Retrieved April 16, 2019.
url: https://dragos.com/resource/xenotime/
source_name: FireEye TEMP.Veles 2018
description: FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.
url: https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html
source_name: FireEye TRITON 2019
description: Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.
url: https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html
source_name: FireEye TEMP.Veles JSON April 2019
description: Miller, S., et al. (2019, April 10). TRITON Appendix C. Retrieved April 29, 2019.
url: https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html
source_name: Pylos Xenotime 2019
description: Slowik, J.. (2019, April 12). A XENOTIME to Remember: Veles in the Wild. Retrieved April 16, 2019.
url: https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/
source_name: XENOTIME
description: The activity group XENOTIME, as defined by Dragos, has overlaps with activity reported upon by FireEye about TEMP.Veles as well as the actors behind [TRITON](https://attack.mitre.org/software/S0609).(Citation: Dragos Xenotime 2018)(Citation: Pylos Xenotime 2019)(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-10T16:02:48.078Z
name: 2022 Ukraine Electric Power Attack
description: The [2022 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0034) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org/software/S0693), and living of the land (LotL) techniques to gain access to a Ukrainian electric utility to send unauthorized commands from their SCADA system.(Citation: Mandiant-Sandworm-Ukraine-2022)(Citation: Dragos-Sandworm-Ukraine-2022) 
aliases: 2022 Ukraine Electric Power Attack
first_seen: 2022-06-01T04:00:00.000Z
last_seen: 2022-10-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: Mandiant-Sandworm-Ukraine-2022)
x_mitre_last_seen_citation: (Citation: Mandiant-Sandworm-Ukraine-2022)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--df8eb785-70f8-4300-b444-277ba849083d
created: 2024-03-27T19:43:25.703Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0034
external_id: C0034
source_name: Dragos-Sandworm-Ukraine-2022
description: Dragos, Inc.. (2023, December 11). ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022. Retrieved March 28, 2024.
url: https://www.dragos.com/blog/new-details-electrum-ukraine-electric-sector-compromise-2022/
source_name: Mandiant-Sandworm-Ukraine-2022
description: Ken Proska, John Wolfram, Jared Wilson, Dan Black, Keith Lunden, Daniel Kapellmann Zafra, Nathan Brubaker, Tyler Mclellan, Chris Sistrunk. (2023, November 9). Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology. Retrieved March 28, 2024.
url: https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
ics-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--6b9ebeb5-20bf-48b0-afb7-988d769a2f01
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0079
external_id: G0079
source_name: DarkHydrus
description: (Citation: Unit 42 DarkHydrus July 2018)
source_name: Unit 42 DarkHydrus July 2018
description: Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/
source_name: Unit 42 Playbook Dec 2017
description: Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
url: https://pan-unit42.github.io/playbook_viewer/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:28.547Z
name: DarkHydrus
description: [DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks. (Citation: Unit 42 DarkHydrus July 2018) (Citation: Unit 42 Playbook Dec 2017)
aliases: DarkHydrus
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Oleg Skulkin, Group-IB
modified: 2024-04-10T20:43:09.698Z
name: Whitefly
description: [Whitefly](https://attack.mitre.org/groups/G0107) is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.(Citation: Symantec Whitefly March 2019)
aliases: Whitefly
x_mitre_deprecated: no
x_mitre_version: 1.2
type: intrusion-set
spec_version: 2.1
id: intrusion-set--b74f909f-8e52-4b69-b770-162bf59a1b4e
created: 2020-05-26T16:55:09.674Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0107
external_id: G0107
source_name: Symantec Whitefly March 2019
description: Symantec. (2019, March 6). Whitefly: Espionage Group has Singapore in Its Sights. Retrieved May 26, 2020.
url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5