auren-research/cyber-sec huggingface dataset:
type: campaign
spec_version: 2.1
id: campaign--b4e5a4a9-f3be-4631-ba8f-da6ebb067fac
created: 2022-09-22T17:12:02.893Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0011
external_id: C0011
source_name: Cisco Talos Transparent Tribe Education Campaign July 2022
description: N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.
url: https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:47.897Z
name: C0011
description: [C0011](https://attack.mitre.org/campaigns/C0011) was a suspected cyber espionage campaign conducted by [Transparent Tribe](https://attack.mitre.org/groups/G0134) that targeted students at universities and colleges in India. Security researchers noted this campaign against students was a significant shift from [Transparent Tribe](https://attack.mitre.org/groups/G0134)'s historic targeting Indian government, military, and think tank personnel, and assessed it was still ongoing as of July 2022.(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022) 
aliases: C0011
first_seen: 2021-12-01T06:00:00.000Z
last_seen: 2022-07-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
x_mitre_last_seen_citation: (Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
modified: 2024-04-11T03:03:44.056Z
name: APT18
description: [APT18](https://attack.mitre.org/groups/G0026) is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical. (Citation: Dell Lateral Movement)
aliases: APT18
TG-0416
Dynamite Panda
Threat Group-0416
x_mitre_deprecated: no
x_mitre_version: 2.2
type: intrusion-set
spec_version: 2.1
id: intrusion-set--38fd6a28-3353-4f2b-bb2b-459fecd5c648
created: 2017-05-31T21:31:57.733Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0026
external_id: G0026
source_name: Threat Group-0416
description: (Citation: ThreatStream Evasion Analysis)
source_name: APT18
description: (Citation: ThreatStream Evasion Analysis)(Citation: Anomali Evasive Maneuvers July 2015)
source_name: TG-0416
description: (Citation: ThreatStream Evasion Analysis)(Citation: Anomali Evasive Maneuvers July 2015)
source_name: Dynamite Panda
description: (Citation: ThreatStream Evasion Analysis)(Citation: Anomali Evasive Maneuvers July 2015)
source_name: Dell Lateral Movement
description: Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016.
url: http://www.secureworks.com/resources/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems/
source_name: Anomali Evasive Maneuvers July 2015
description: Shelmire, A. (2015, July 06). Evasive Maneuvers by the Wekby group with custom ROP-packing and DNS covert channels. Retrieved November 15, 2018.
url: https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop
source_name: ThreatStream Evasion Analysis
description: Shelmire, A.. (2015, July 6). Evasive Maneuvers. Retrieved January 22, 2016.
url: https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--55033a4d-3ffe-46b2-99b4-2c1541e9ce1c
created: 2017-05-31T21:31:49.021Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0008
external_id: G0008
source_name: Carbanak
description: (Citation: Kaspersky Carbanak) (Citation: Fox-It Anunak Feb 2015)
source_name: Anunak
description: (Citation: Fox-It Anunak Feb 2015)
source_name: Kaspersky Carbanak
description: Kaspersky Lab's Global Research and Analysis Team. (2015, February). CARBANAK APT THE GREAT BANK ROBBERY. Retrieved August 23, 2018.
url: https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
source_name: FireEye FIN7 April 2017
description: Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.
url: https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
source_name: Europol Cobalt Mar 2018
description: Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018.
url: https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain
source_name: Secureworks GOLD NIAGARA Threat Profile
description: CTU. (n.d.). GOLD NIAGARA. Retrieved September 21, 2021.
url: https://www.secureworks.com/research/threat-profiles/gold-niagara
source_name: Secureworks GOLD KINGSWOOD Threat Profile
description: Secureworks. (n.d.). GOLD KINGSWOOD. Retrieved October 18, 2021.
url: https://www.secureworks.com/research/threat-profiles/gold-kingswood?filter=item-financial-gain
source_name: Fox-It Anunak Feb 2015
description: Prins, R. (2015, February 16). Anunak (aka Carbanak) Update. Retrieved January 20, 2017.
url: https://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:30.378Z
name: Carbanak
description: [Carbanak](https://attack.mitre.org/groups/G0008) is a cybercriminal group that has used [Carbanak](https://attack.mitre.org/software/S0030) malware to target financial institutions since at least 2013. [Carbanak](https://attack.mitre.org/groups/G0008) may be linked to groups tracked separately as [Cobalt Group](https://attack.mitre.org/groups/G0080) and [FIN7](https://attack.mitre.org/groups/G0046) that have also used [Carbanak](https://attack.mitre.org/software/S0030) malware.(Citation: Kaspersky Carbanak)(Citation: FireEye FIN7 April 2017)(Citation: Europol Cobalt Mar 2018)(Citation: Secureworks GOLD NIAGARA Threat Profile)(Citation: Secureworks GOLD KINGSWOOD Threat Profile)
aliases: Carbanak
Anunak
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Anastasios Pingios
modified: 2024-04-10T21:33:28.444Z
name: Orangeworm
description: [Orangeworm](https://attack.mitre.org/groups/G0071) is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Symantec Orangeworm April 2018) Reverse engineering of [Kwampirs](https://attack.mitre.org/software/S0236), directly associated with [Orangeworm](https://attack.mitre.org/groups/G0071) activity, indicates significant functional and development overlaps with [Shamoon](https://attack.mitre.org/software/S0140).(Citation: Cylera Kwampirs 2022)
aliases: Orangeworm
x_mitre_deprecated: no
x_mitre_version: 2.0
x_mitre_contributors: Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre
type: intrusion-set
spec_version: 2.1
id: intrusion-set--5636b7b3-d99b-4edd-aa05-ee649c1d4ef1
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0071
external_id: G0071
source_name: Orangeworm
description: (Citation: Symantec Orangeworm April 2018)
source_name: Cylera Kwampirs 2022
description: Pablo Rincón Crespo. (2022, January). The link between Kwampirs (Orangeworm) and Shamoon APTs. Retrieved February 8, 2024.
url: https://resources.cylera.com/hubfs/Cylera%20Labs/Cylera%20Labs%20Kwampirs%20Shamoon%20Technical%20Report.pdf
source_name: Symantec Orangeworm April 2018
description: Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
url: https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-02-19T20:00:20.463Z
name: J-magic Campaign
description: The [J-magic Campaign](https://attack.mitre.org/campaigns/C0050) was active from mid-2023 to at least mid-2024 and featured the use of the [J-magic](https://attack.mitre.org/software/S1203) backdoor, a custom cd00r variant tailored for use against Juniper routers. The [J-magic Campaign](https://attack.mitre.org/campaigns/C0050) targeted Junos OS routers serving as VPN gateways primarily in the semiconductor, energy, manufacturing, and IT sectors. (Citation: Lumen J-Magic JAN 2025)
aliases: J-magic Campaign
first_seen: 2023-06-01T04:00:00.000Z
last_seen: 2024-06-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: Lumen J-Magic JAN 2025)
x_mitre_last_seen_citation: (Citation: Lumen J-Magic JAN 2025)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--58c4fd17-88f5-433a-8242-e9cac31f3c45
created: 2025-02-18T16:00:42.489Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0050
external_id: C0050
source_name: Lumen J-Magic JAN 2025
description: Black Lotus Labs. (2025, January 23). The J-Magic Show: Magic Packets and Where to find them. Retrieved February 17, 2025.
url: https://blog.lumen.com/the-j-magic-show-magic-packets-and-where-to-find-them/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2024-11-17T16:15:02.223Z
name: Triton Safety Instrumented System Attack
description: [Triton Safety Instrumented System Attack](https://attack.mitre.org/campaigns/C0030) was a campaign employed by [TEMP.Veles](https://attack.mitre.org/groups/G0088) which leveraged the [Triton](https://attack.mitre.org/software/S1009) malware framework against a petrochemical organization.(Citation: Triton-EENews-2017) The malware and techniques used within this campaign targeted specific Triconex [Safety Controller](https://attack.mitre.org/assets/A0010)s within the environment.(Citation: FireEye TRITON 2018) The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.(Citation: FireEye TRITON 2017)

aliases: Triton Safety Instrumented System Attack
first_seen: 2017-06-01T04:00:00.000Z
last_seen: 2017-08-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: Triton-EENews-2017)
x_mitre_last_seen_citation: (Citation: Triton-EENews-2017)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--45a98f02-852f-49b2-94c0-c63207bebbbf
created: 2024-03-25T17:47:37.619Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0030
external_id: C0030
source_name: Triton-EENews-2017
description: Blake Sobczak. (2019, March 7). The inside story of the world’s most dangerous malware. Retrieved March 25, 2024.
url: https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/
source_name: FireEye TRITON 2017
description: Johnson, B, et. al. (2017, December 14). Attackers Deploy New ICS Attack Framework "TRITON" and Cause Operational Disruption to Critical Infrastructure. Retrieved January 6, 2021.
url: https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html
source_name: FireEye TRITON 2018
description: Miller, S. Reese, E. (2018, June 7). A Totally Tubular Treatise on TRITON and TriStation. Retrieved November 17, 2024.
url: https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: ics-attack
enterprise-attack
modified: 2025-03-05T22:12:26.131Z
name: FrostyGoop Incident
description: [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, [FrostyGoop](https://attack.mitre.org/software/S1165) was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)
aliases: FrostyGoop Incident
first_seen: 2024-01-01T07:00:00.000Z
last_seen: 2024-01-01T07:00:00.000Z
x_mitre_first_seen_citation: (Citation: Dragos FROSTYGOOP 2024)
x_mitre_last_seen_citation: (Citation: Dragos FROSTYGOOP 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--1169ff24-b35f-4d8d-8cf3-643a2834227f
created: 2024-11-20T23:15:36.728Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0041
external_id: C0041
source_name: Dragos FROSTYGOOP 2024
description: Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.
url: https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf
source_name: Nozomi BUSTLEBERM 2024
description: Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.
url: https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: ics-attack
enterprise-attack
modified: 2024-10-03T10:11:13.072Z
name: KV Botnet Activity
description: [KV Botnet Activity](https://attack.mitre.org/campaigns/C0035) consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https://attack.mitre.org/campaigns/C0035) was used by [Volt Typhoon](https://attack.mitre.org/groups/G1017) to obfuscate connectivity to victims in multiple critical infrastructure segments, including energy and telecommunication companies and entities based on the US territory of Guam. While the KV Botnet is the most prominent element of this campaign, it overlaps with another botnet cluster referred to as the JDY cluster.(Citation: Lumen KVBotnet 2023) This botnet was disrupted by US law enforcement entities in early 2024 after periods of activity from October 2022 through January 2024.(Citation: DOJ KVBotnet 2024)
aliases: KV Botnet Activity
first_seen: 2022-10-01T04:00:00.000Z
last_seen: 2024-01-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Lumen KVBotnet 2023)
x_mitre_last_seen_citation: (Citation: DOJ KVBotnet 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--0c259854-4044-4f6c-ac49-118d484b3e3b
created: 2024-06-10T18:57:09.920Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0035
external_id: C0035
source_name: Lumen KVBotnet 2023
description: Black Lotus Labs. (2023, December 13). Routers Roasting On An Open Firewall: The KV-Botnet Investigation. Retrieved June 10, 2024.
url: https://blog.lumen.com/routers-roasting-on-an-open-firewall-the-kv-botnet-investigation/
source_name: DOJ KVBotnet 2024
description: US Department of Justice. (2024, January 31). U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure. Retrieved June 10, 2024.
url: https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c4d50cdf-87ce-407d-86d8-862883485842
created: 2020-05-05T18:53:08.166Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0099
external_id: G0099
source_name: Blind Eagle
description: (Citation: QiAnXin APT-C-36 Feb2019)
source_name: QiAnXin APT-C-36 Feb2019
description: QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.
url: https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:32.503Z
name: APT-C-36
description: [APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South America espionage group that has been active since at least 2018. The group mainly targets Colombian government institutions as well as important corporations in the financial sector, petroleum industry, and professional manufacturing.(Citation: QiAnXin APT-C-36 Feb2019)
aliases: APT-C-36
Blind Eagle
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Jose Luis Sánchez Martinez
type: intrusion-set
spec_version: 2.1
id: intrusion-set--6688d679-ccdb-4f12-abf6-c7545dd767a4
created: 2019-05-02T00:08:18.314Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0089
external_id: G0089
source_name: Cylance Shaheen Nov 2018
description: Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.
url: https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:32.865Z
name: The White Company
description: [The White Company](https://attack.mitre.org/groups/G0089) is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)
aliases: The White Company
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--7ecc3b4f-5cdb-457e-b55a-df376b359446
created: 2017-05-31T21:32:04.179Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0033
external_id: G0033
source_name: Poseidon Group
description: (Citation: Kaspersky Poseidon Group)
source_name: Kaspersky Poseidon Group
description: Kaspersky Lab's Global Research and Analysis Team. (2016, February 9). Poseidon Group: a Targeted Attack Boutique specializing in global cyber-espionage. Retrieved March 16, 2016.
url: https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:33.223Z
name: Poseidon Group
description: [Poseidon Group](https://attack.mitre.org/groups/G0033) is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the [Poseidon Group](https://attack.mitre.org/groups/G0033) as a security firm. (Citation: Kaspersky Poseidon Group)
aliases: Poseidon Group
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
modified: 2024-11-17T14:12:07.294Z
name: LazyScripter
description: [LazyScripter](https://attack.mitre.org/groups/G0140) is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)
aliases: LazyScripter
x_mitre_deprecated: no
x_mitre_version: 1.1
x_mitre_contributors: Manikantan Srinivasan, NEC Corporation India
Pooja Natarajan, NEC Corporation India
Hiroki Nagahama, NEC Corporation
type: intrusion-set
spec_version: 2.1
id: intrusion-set--abc5a1d4-f0dc-49d1-88a1-4a80e478bb03
created: 2021-11-24T19:26:27.305Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0140
external_id: G0140
source_name: LazyScripter
description: (Citation: MalwareBytes LazyScripter Feb 2021)
source_name: MalwareBytes LazyScripter Feb 2021
description: Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
url: https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--2fd2be6a-d3a2-4a65-b499-05ea2693abee
created: 2019-01-30T14:26:42.897Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0084
external_id: G0084
source_name: Gallmaker
description: (Citation: Symantec Gallmaker Oct 2018)
source_name: Symantec Gallmaker Oct 2018
description: Symantec Security Response. (2018, October 10). Gallmaker: New Attack Group Eschews Malware to Live off the Land. Retrieved November 27, 2018.
url: https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:49:34.304Z
name: Gallmaker
description: [Gallmaker](https://attack.mitre.org/groups/G0084) is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.(Citation: Symantec Gallmaker Oct 2018)
aliases: Gallmaker
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0