auren-research/cyber-sec huggingface dataset:
modified: 2024-04-11T00:36:23.822Z
name: Night Dragon
description: [Night Dragon](https://attack.mitre.org/campaigns/C0002) was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.(Citation: McAfee Night Dragon)
aliases: Night Dragon
first_seen: 2009-11-01T04:00:00.000Z
last_seen: 2011-02-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: McAfee Night Dragon)
x_mitre_last_seen_citation: (Citation: McAfee Night Dragon)
x_mitre_deprecated: no
x_mitre_version: 1.1
type: campaign
spec_version: 2.1
id: campaign--ae407e32-87e0-4d92-8705-3ae25d504d8a
created: 2022-09-08T13:31:37.391Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0002
external_id: C0002
source_name: McAfee Night Dragon
description: McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.
url: https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
type: campaign
spec_version: 2.1
id: campaign--7854c1a0-f06c-4876-98a4-4bbd34751b05
created: 2023-03-23T17:51:58.539Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0023
external_id: C0023
source_name: ESET Dukes October 2019
description: Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.
url: https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:47.386Z
name: Operation Ghost
description: [Operation Ghost](https://attack.mitre.org/campaigns/C0023) was an [APT29](https://attack.mitre.org/groups/G0016) campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During [Operation Ghost](https://attack.mitre.org/campaigns/C0023), [APT29](https://attack.mitre.org/groups/G0016) used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.(Citation: ESET Dukes October 2019)

aliases: Operation Ghost
first_seen: 2013-09-01T04:00:00.000Z
last_seen: 2019-10-01T04:00:00.000Z
x_mitre_first_seen_citation: (Citation: ESET Dukes October 2019)
x_mitre_last_seen_citation: (Citation: ESET Dukes October 2019)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack
modified: 2024-08-29T15:18:44.308Z
name: Agrius
description: [Agrius](https://attack.mitre.org/groups/G1030) is an Iranian threat actor active since 2020 notable for a series of ransomware and wiper operations in the Middle East, with an emphasis on Israeli targets.(Citation: SentinelOne Agrius 2021)(Citation: CheckPoint Agrius 2023) Public reporting has linked [Agrius](https://attack.mitre.org/groups/G1030) to Iran's Ministry of Intelligence and Security (MOIS).(Citation: Microsoft Iran Cyber 2023)
aliases: Agrius
Pink Sandstorm
AMERICIUM
Agonizing Serpens
BlackShadow
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Asritha Narina
type: intrusion-set
spec_version: 2.1
id: intrusion-set--b8137919-38cb-4db0-90f3-437be885faba
created: 2024-05-21T19:13:23.526Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1030
external_id: G1030
source_name: BlackShadow
description: (Citation: CheckPoint Agrius 2023)
source_name: Pink Sandstorm
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: AMERICIUM
description: (Citation: Microsoft Threat Actor Naming July 2023)
source_name: Agonizing Serpens
description: (Citation: Unit42 Agrius 2023)
source_name: SentinelOne Agrius 2021
description: Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.
url: https://assets.sentinelone.com/sentinellabs/evol-agrius
source_name: CheckPoint Agrius 2023
description: Marc Salinas Fernandez & Jiri Vinopal. (2023, May 23). AGRIUS DEPLOYS MONEYBIRD IN TARGETED ATTACKS AGAINST ISRAELI ORGANIZATIONS. Retrieved May 21, 2024.
url: https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/
source_name: Microsoft Threat Actor Naming July 2023
description: Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
url: https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
source_name: Microsoft Iran Cyber 2023
description: Microsoft Threat Intelligence. (2023, May 2). Iran turning to cyber-enabled influence operations for greater effect. Retrieved May 21, 2024.
url: https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/05/Iran-turning-to-cyber-enabled-influence-operations-for-greater-effect-05022023.pdf
source_name: Unit42 Agrius 2023
description: Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.
url: https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-03-13T20:55:26.608Z
name: Indian Critical Infrastructure Intrusions
description: [Indian Critical Infrastructure Intrusions](https://attack.mitre.org/campaigns/C0043) is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.mitre.org/groups/G1042) and Threat Activity Group 38 (TAG38). The intrusions appear focused on IT system breach in Indian electric utility entities and logistics firms, as well as potentially managed service providers operating within India. Although focused on OT-operating entities, there is no evidence this campaign was able to progress beyond IT breach and information gathering to OT environment access.(Citation: RecordedFuture RedEcho 2021)(Citation: RecordedFuture RedEcho 2022)
aliases: Indian Critical Infrastructure Intrusions
first_seen: 2021-01-01T07:00:00.000Z
last_seen: 2022-04-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: RecordedFuture RedEcho 2021)
x_mitre_last_seen_citation: (Citation: RecordedFuture RedEcho 2022)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--4b7f9839-4822-4c19-8a1f-70bb61ba97e1
created: 2024-11-21T22:45:01.292Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0043
external_id: C0043
source_name: RecordedFuture RedEcho 2021
description: Recorded Future Insikt Group. (2021, February). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved November 21, 2024.
url: https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf
source_name: RecordedFuture RedEcho 2022
description: Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.
url: https://go.recordedfuture.com/hubfs/reports/ta-2022-0406.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2025-03-28T15:28:31.727Z
name: Sea Turtle
description: [Sea Turtle](https://attack.mitre.org/groups/G1041) is a Türkiye-linked threat actor active since at least 2017 performing espionage and service provider compromise operations against victims in Asia, Europe, and North America. [Sea Turtle](https://attack.mitre.org/groups/G1041) is notable for targeting registrars managing ccTLDs and complex DNS-based intrusions where the threat actor compromised DNS providers to hijack DNS resolution for ultimate victims, enabling [Sea Turtle](https://attack.mitre.org/groups/G1041) to spoof log in portals and other applications for credential collection.(Citation: Talos Sea Turtle 2019)(Citation: Talos Sea Turtle 2019_2)(Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)
aliases: Sea Turtle
Teal Kurma
Marbled Dust
Cosmic Wolf
SILICON
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Inna Danilevich, U.S. Bank
Joe Gumke, U.S. Bank
type: intrusion-set
spec_version: 2.1
id: intrusion-set--56a05d27-4d47-418a-b330-781c5614f202
created: 2024-11-20T18:21:28.242Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1041
external_id: G1041
source_name: SILICON
description: (Citation: Microsoft Digital Defense 2021)(Citation: Hunt Sea Turtle 2024)
source_name: Teal Kurma
description: (Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)
source_name: Marbled Dust
description: (Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)
source_name: Cosmic Wolf
description: (Citation: PWC Sea Turtle 2023)(Citation: Hunt Sea Turtle 2024)
source_name: Talos Sea Turtle 2019
description: Cisco Talos. (2019, April 17). Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service. Retrieved November 20, 2024.
url: https://blog.talosintelligence.com/seaturtle/
source_name: Hunt Sea Turtle 2024
description: Hunt & Hackett Research Team. (2024, January 5). Turkish espionage campaigns in the Netherlands. Retrieved November 20, 2024.
url: https://www.huntandhackett.com/blog/turkish-espionage-campaigns
source_name: Microsoft Digital Defense 2021
description: Microsoft. (2021, October). Microsoft Digital Defense Report. Retrieved November 20, 2024.
url: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi?id=101738
source_name: Talos Sea Turtle 2019_2
description: Paul Rascagneres. (2019, July 9). Sea Turtle keeps on swimming, finds new victims, DNS hijacking techniques. Retrieved November 20, 2024.
url: https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/
source_name: PWC Sea Turtle 2023
description: PwC Threat Intelligence. (2023, December 5). The Tortoise and The Malware. Retrieved November 20, 2024.
url: https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-02-09T19:30:38.407Z
name: Rancor
description: [Rancor](https://attack.mitre.org/groups/G0075) is a threat group that has led targeted campaigns against the South East Asia region. [Rancor](https://attack.mitre.org/groups/G0075) uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)
aliases: Rancor
x_mitre_deprecated: no
x_mitre_version: 1.3
type: intrusion-set
spec_version: 2.1
id: intrusion-set--f40eb8ce-2a74-4e56-89a1-227021410142
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0075
external_id: G0075
source_name: Rancor
description: (Citation: Rancor Unit42 June 2018)
source_name: Rancor Unit42 June 2018
description: Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-03-14T12:46:03.740Z
name: Leviathan Australian Intrusions
description: [Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) consisted of at least two long-term intrusions against victims in Australia by [Leviathan](https://attack.mitre.org/groups/G0065), relying on similar tradecraft such as external service exploitation followed by extensive credential capture and re-use to enable privilege escalation and lateral movement. [Leviathan Australian Intrusions](https://attack.mitre.org/campaigns/C0049) were focused on exfiltrating sensitive data including valid credentials for the victim organizations.(Citation: CISA Leviathan 2024)
aliases: Leviathan Australian Intrusions
first_seen: 2022-04-01T06:00:00.000Z
last_seen: 2022-09-01T06:00:00.000Z
x_mitre_first_seen_citation: (Citation: CISA Leviathan 2024)
x_mitre_last_seen_citation: (Citation: CISA Leviathan 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
type: campaign
spec_version: 2.1
id: campaign--b66bc597-399c-4e4d-828a-1ed4a7f1fb15
created: 2025-02-03T19:41:59.392Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0049
external_id: C0049
source_name: CISA Leviathan 2024
description: CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.
url: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2024-10-01T11:51:31.065Z
name: Moonstone Sleet
description: [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is a North Korean-linked threat actor executing both financially motivated attacks and espionage operations. The group previously overlapped significantly with another North Korean-linked entity, [Lazarus Group](https://attack.mitre.org/groups/G0032), but has differentiated its tradecraft since 2023. [Moonstone Sleet](https://attack.mitre.org/groups/G1036) is notable for creating fake companies and personas to interact with victim entities, as well as developing unique malware such as a variant delivered via a fully functioning game.(Citation: Microsoft Moonstone Sleet 2024)
aliases: Moonstone Sleet
Storm-1789
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Aung Kyaw Min Naing, @Nolan
type: intrusion-set
spec_version: 2.1
id: intrusion-set--e6db1e55-b199-4b6b-8633-989345ee45e0
created: 2024-08-26T17:39:06.020Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1036
external_id: G1036
source_name: Storm-1789
description: (Citation: Microsoft Moonstone Sleet 2024)
source_name: Microsoft Moonstone Sleet 2024
description: Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.
url: https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: intrusion-set
spec_version: 2.1
id: intrusion-set--94873029-f950-4268-9cfd-5032e15cb182
created: 2021-03-19T21:04:00.692Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G0127
external_id: G0127
source_name: GOLD CABIN
description: (Citation: Secureworks GOLD CABIN)
source_name: Shathak
description: (Citation: Unit 42 Valak July 2020)(Citation: Unit 42 TA551 Jan 2021)
source_name: Unit 42 Valak July 2020
description: Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
url: https://unit42.paloaltonetworks.com/valak-evolution/
source_name: Unit 42 TA551 Jan 2021
description: Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.
url: https://unit42.paloaltonetworks.com/ta551-shathak-icedid/
source_name: Secureworks GOLD CABIN
description: Secureworks. (n.d.). GOLD CABIN Threat Profile. Retrieved March 17, 2021.
url: https://www.secureworks.com/research/threat-profiles/gold-cabin
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:36.634Z
name: TA551
description: [TA551](https://attack.mitre.org/groups/G0127) is a financially-motivated threat group that has been active since at least 2018. (Citation: Secureworks GOLD CABIN) The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. (Citation: Unit 42 TA551 Jan 2021)
aliases: TA551
GOLD CABIN
Shathak
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Shuhei Sasada, Cyber Defense Institute, Inc
Ryo Tamura, SecureBrain Corporation
Shotaro Hamamoto, NEC Solution Innovators, Ltd
Yusuke Niwa, ITOCHU Corporation
Takuma Matsumoto, LAC Co., Ltd
modified: 2024-10-28T19:02:30.340Z
name: Water Curupira Pikabot Distribution
description: [Pikabot](https://attack.mitre.org/software/S1145) was distributed in [Water Curupira Pikabot Distribution](https://attack.mitre.org/campaigns/C0037) throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of [QakBot](https://attack.mitre.org/software/S0650), with several technical overlaps and similarities with [QakBot](https://attack.mitre.org/software/S0650), indicating a possible connection. The identified activity led to the deployment of tools such as [Cobalt Strike](https://attack.mitre.org/software/S0154), while coinciding with campaigns delivering [DarkGate](https://attack.mitre.org/software/S1111) and [IcedID](https://attack.mitre.org/software/S0483) en route to ransomware deployment.(Citation: TrendMicro Pikabot 2024)
aliases: Water Curupira Pikabot Distribution
first_seen: 2023-01-01T05:00:00.000Z
last_seen: 2023-12-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: TrendMicro Pikabot 2024)
x_mitre_last_seen_citation: (Citation: TrendMicro Pikabot 2024)
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_contributors: Inna Danilevich, U.S. Bank
type: campaign
spec_version: 2.1
id: campaign--57541e3b-657e-463a-a4ab-ca08d7ea9965
created: 2024-07-17T20:23:22.945Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0037
external_id: C0037
source_name: TrendMicro Pikabot 2024
description: Shinji Robert Arasawa, Joshua Aquino, Charles Steven Derion, Juhn Emmanuel Atanque, Francisrey Joshua Castillo, John Carlo Marquez, Henry Salcedo, John Rainier Navato, Arianne Dela Cruz, Raymart Yambot & Ian Kenefick. (2024, January 9). Black Basta-Affiliated Water Curupira’s Pikabot Spam Campaign. Retrieved July 17, 2024.
url: https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_domains: enterprise-attack
modified: 2025-03-06T20:09:16.402Z
name: Salt Typhoon
description: [Salt Typhoon](https://attack.mitre.org/groups/G1045) is a People's Republic of China (PRC) state-backed actor that has been active since at least 2019 and responsible for numerous compromises of network infrastructure at major U.S. telecommunication and internet service providers (ISP).(Citation: US Dept. of Treasury Salt Typhoon JAN 2025)(Citation: Cisco Salt Typhoon FEB 2025)

aliases: Salt Typhoon
x_mitre_deprecated: no
x_mitre_version: 1.0
type: intrusion-set
spec_version: 2.1
id: intrusion-set--1c3dcf91-b859-4aae-a09c-ae26dc8b6390
created: 2025-02-24T20:45:14.093Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/groups/G1045
external_id: G1045
source_name: Cisco Salt Typhoon FEB 2025
description: Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.
url: https://blog.talosintelligence.com/salt-typhoon-analysis/
source_name: US Dept. of Treasury Salt Typhoon JAN 2025
description: US Department of Treasury. (2025, January 17). Treasury Sanctions Company Associated with Salt Typhoon and Hacker Associated with Treasury Compromise. Retrieved February 24, 2025.
url: https://home.treasury.gov/news/press-releases/jy2792
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_domains: enterprise-attack
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5