auren-research/cyber-sec huggingface dataset:
modified: 2024-10-10T14:31:59.099Z
name: Aquatic Panda
description: [Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org/groups/G0143) has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)
aliases: Aquatic Panda
x_mitre_deprecated: no
x_mitre_version: 2.0
x_mitre_contributors: NST Assure Research Team, NetSentries Technologies
Pooja Natarajan, NEC Corporation India
Hiroki Nagahama, NEC Corporation
Manikantan Srinivasan, NEC Corporation India
Jai Minton, CrowdStrike
Jennifer Kim Roman, CrowdStrike
type: intrusion-set
spec_version: 2.1
id: intrusion-set--64b52e7d-b2c4-4a02-9372-08a463f5dc11
created: 2022-01-18T14:49:29.505Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0143
external_id: G0143
source_name: CrowdStrike AQUATIC PANDA December 2021
description: Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.
url: https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-10-31T18:33:10.434Z
name: Daggerfly
description: [Daggerfly](https://attack.mitre.org/groups/G1034) is a People's Republic of China-linked APT entity active since at least 2012. [Daggerfly](https://attack.mitre.org/groups/G1034) has targeted individuals, government and NGO entities, and telecommunication companies in Asia and Africa. [Daggerfly](https://attack.mitre.org/groups/G1034) is associated with exclusive use of [MgBot](https://attack.mitre.org/software/S1146) malware and is noted for several potential supply chain infection campaigns.(Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2024)(Citation: ESET EvasivePanda 2024)
aliases: Daggerfly
Evasive Panda
BRONZE HIGHLAND
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Furkan Celik, PURE7
type: intrusion-set
spec_version: 2.1
id: intrusion-set--f3be6240-f68e-47e1-90d2-ad8f3b3bb8a6
created: 2024-07-25T17:13:06.098Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1034
external_id: G1034
source_name: Evasive Panda
description: (Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2024)
source_name: BRONZE HIGHLAND
description: (Citation: Symantec Daggerfly 2023)(Citation: ESET EvasivePanda 2024)
source_name: ESET EvasivePanda 2024
description: Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.
url: https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/
source_name: ESET EvasivePanda 2023
description: Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.
url: https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/
source_name: Symantec Daggerfly 2023
description: Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.
url: https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot
source_name: Symantec Daggerfly 2024
description: Threat Hunter Team. (2024, July 23). Daggerfly: Espionage Group Makes Major Update to Toolset. Retrieved July 25, 2024.
url: https://symantec-enterprise-blogs.security.com/threat-intelligence/daggerfly-espionage-updated-toolset
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: campaign
spec_version: 2.1
id: campaign--ab747e62-1bcb-479f-a26b-1cd39d413d81
created: 2022-09-21T22:16:42.003Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0010
external_id: C0010
source_name: Mandiant UNC3890 Aug 2022
description: Mandiant Israel Research Team. (2022, August 17). Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors. Retrieved September 21, 2022.
url: https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:46.129Z
name: C0010
description: [C0010](https://attack.mitre.org/campaigns/C0010) was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts operations in support of Iranian interests, and noted several limited technical connections to Iran, including PDB strings and Farsi language artifacts. [C0010](https://attack.mitre.org/campaigns/C0010) began by at least late 2020, and was still ongoing as of mid-2022.(Citation: Mandiant UNC3890 Aug 2022)
aliases: C0010
first_seen: 2020-12-01T07:00:00.000Z
last_seen: 2022-08-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: Mandiant UNC3890 Aug 2022)
x_mitre_last_seen_citation: (Citation: Mandiant UNC3890 Aug 2022)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
modified: 2024-04-11T02:15:23.096Z
name: Inception
description: [Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)
aliases: Inception
Inception Framework
Cloud Atlas
x_mitre_deprecated: no
x_mitre_version: 1.2
x_mitre_contributors: Oleg Skulkin, Group-IB
type: intrusion-set
spec_version: 2.1
id: intrusion-set--ead23196-d7b6-4ce6-a124-4ab4b67d81bd
created: 2020-05-08T17:01:04.058Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0100
external_id: G0100
source_name: Cloud Atlas
description: (Citation: Kaspersky Cloud Atlas December 2014)
source_name: Inception
description: (Citation: Symantec Inception Framework March 2018)
source_name: Inception Framework
description: (Citation: Symantec Inception Framework March 2018)
source_name: Kaspersky Cloud Atlas December 2014
description: GReAT. (2014, December 10). Cloud Atlas: RedOctober APT is back in style. Retrieved May 8, 2020.
url: https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/
source_name: Unit 42 Inception November 2018
description: Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.
url: https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/
source_name: Symantec Inception Framework March 2018
description: Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.
url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--16ade1aa-0ea1-4bb7-88cc-9079df2ae756
created: 2017-05-31T21:31:53.579Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0018
external_id: G0018
source_name: admin@338
description: (Citation: FireEye admin@338)
source_name: FireEye admin@338
description: FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
url: https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:48:47.886Z
name: admin@338
description: [admin@338](https://attack.mitre.org/groups/G0018) is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as [PoisonIvy](https://attack.mitre.org/software/S0012), as well as some non-public backdoors. (Citation: FireEye admin@338)
aliases: admin@338
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.
type: intrusion-set
spec_version: 2.1
id: intrusion-set--6fe8a2a1-a1b0-4af8-953d-4babd329f8f8
created: 2020-05-05T18:36:45.970Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0098
external_id: G0098
source_name: Palmerworm
description: (Citation: Symantec Palmerworm Sep 2020)(Citation: IronNet BlackTech Oct 2021)
source_name: TrendMicro BlackTech June 2017
description: Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/
source_name: IronNet BlackTech Oct 2021
description: Demboski, M., et al. (2021, October 26). China cyber attacks: the current threat landscape. Retrieved March 25, 2022.
url: https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape
source_name: Reuters Taiwan BlackTech August 2020
description: Lee, Y. (2020, August 19). Taiwan says China behind cyberattacks on government agencies, emails. Retrieved April 6, 2022.
url: https://www.reuters.com/article/us-taiwan-cyber-china/taiwan-says-china-behind-cyberattacks-on-government-agencies-emails-idUSKCN25F0JK
source_name: Symantec Palmerworm Sep 2020
description: Threat Intelligence. (2020, September 29). Palmerworm: Espionage Gang Targets the Media, Finance, and Other Sectors. Retrieved March 25, 2022.
url: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T19:03:07.787Z
name: BlackTech
description: [BlackTech](https://attack.mitre.org/groups/G0098) is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. [BlackTech](https://attack.mitre.org/groups/G0098) has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)
aliases: BlackTech
Palmerworm
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.
Hannah S
x_mitre_domains: enterprise-attack
modified: 2025-03-08T18:42:45.320Z
name: APT42
description: [APT42](https://attack.mitre.org/groups/G1044) is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.(Citation: Mandiant APT42-charms) The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.(Citation: Mandiant APT42-charms) [APT42](https://attack.mitre.org/groups/G1044) starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.(Citation: Mandiant APT42-charms) Finally, [APT42](https://attack.mitre.org/groups/G1044) exfiltrates data using native features and open-source tools.(Citation: Mandiant APT42-untangling) 

[APT42](https://attack.mitre.org/groups/G1044) activities have been linked to [Magic Hound](https://attack.mitre.org/groups/G0059) by other commercial vendors. While there are behavior and software overlaps between [Magic Hound](https://attack.mitre.org/groups/G0059) and [APT42](https://attack.mitre.org/groups/G1044), they appear to be distinct entities and are tracked as separate entities by their originating vendor. 
aliases: APT42
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Sittikorn Sangrattanapitak
type: intrusion-set
spec_version: 2.1
id: intrusion-set--c0291346-defe-48d7-9542-9e074ba1bdfb
created: 2025-01-08T17:08:26.378Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1044
external_id: G1044
source_name: Mandiant APT42-charms
description: Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.
url: https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf
source_name: Mandiant APT42-untangling
description: Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-03-29T14:10:35.711Z
name: Malteiro
description: [Malteiro](https://attack.mitre.org/groups/G1026) is a financially motivated criminal group that is likely based in Brazil and has been active since at least November 2019. The group operates and distributes the [Mispadu](https://attack.mitre.org/software/S1122) banking trojan via a Malware-as-a-Service (MaaS) business model. [Malteiro](https://attack.mitre.org/groups/G1026) mainly targets victims throughout Latin America (particularly Mexico) and Europe (particularly Spain and Portugal).(Citation: SCILabs Malteiro 2021)
aliases: Malteiro
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Daniel Fernando Soriano Espinosa
SCILabs
type: intrusion-set
spec_version: 2.1
id: intrusion-set--bf668120-e9a6-4017-a014-bfc0f5232656
created: 2024-03-13T20:23:54.698Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1026
external_id: G1026
source_name: SCILabs Malteiro 2021
description: SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.
url: https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: campaign
spec_version: 2.1
id: campaign--93c23946-49af-41f4-ac03-40f9ffc7419b
created: 2022-09-22T20:07:47.208Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0012
external_id: C0012
source_name: Cybereason OperationCuckooBees May 2022
description: Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022.
url: https://www.cybereason.com/blog/operation-cuckoobees-deep-dive-into-stealthy-winnti-techniques
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:46.274Z
name: Operation CuckooBees
description: [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted the goal of [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012), which was still ongoing as of May 2022, was likely the theft of proprietary information, research and development documents, source code, and blueprints for various technologies. Researchers assessed [Operation CuckooBees](https://attack.mitre.org/campaigns/C0012) was conducted by actors affiliated with [Winnti Group](https://attack.mitre.org/groups/G0044), [APT41](https://attack.mitre.org/groups/G0096), and BARIUM.(Citation: Cybereason OperationCuckooBees May 2022)
aliases: Operation CuckooBees
first_seen: 2019-12-01T07:00:00.000Z
last_seen: 2022-05-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: Cybereason OperationCuckooBees May 2022)
x_mitre_last_seen_citation: (Citation: Cybereason OperationCuckooBees May 2022)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Andrea Serrano Urea, Telefónica Tech
x_mitre_domains: enterprise-attack
modified: 2024-11-25T22:05:20.281Z
name: Juicy Mix
description: [Juicy Mix](https://attack.mitre.org/campaigns/C0044) was a campaign conducted by [OilRig](https://attack.mitre.org/groups/G0049) throughout 2022 that targeted Israeli organizations with the [Mango](https://attack.mitre.org/software/S1169) backdoor.(Citation: ESET OilRig Campaigns Sep 2023)
aliases: Juicy Mix
first_seen: 2022-01-01T05:00:00.000Z
last_seen: 2022-12-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: ESET OilRig Campaigns Sep 2023)
x_mitre_last_seen_citation: (Citation: ESET OilRig Campaigns Sep 2023)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--7ab2f1a1-26af-4204-ad84-d640fde391da
created: 2024-11-25T20:35:10.872Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0044
external_id: C0044
source_name: ESET OilRig Campaigns Sep 2023
description: Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.
url: https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2024-10-02T05:37:34.149Z
name: Play
description: [Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Play](https://attack.mitre.org/groups/G1040) actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
aliases: Play
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Marco Pedrinazzi, @pedrinazziM
type: intrusion-set
spec_version: 2.1
id: intrusion-set--ecbf507f-6786-4121-a4cc-0fd6a8d3a29d
created: 2024-09-24T19:48:18.278Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1040
external_id: G1040
source_name: CISA Play Ransomware Advisory December 2023
description: CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.
url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
source_name: Trend Micro Ransomware Spotlight Play July 2023
description: Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.
url: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5