02-28-2025, 04:03 PM
LIST OF RESOURCES:
- MITRE ATT&CK Groups: (https://attack.mitre.org/groups/G0067) Provides comprehensive profiles of various APT groups, including their known tactics, techniques, and procedures (TTPs), associated software, and references to public reporting. This specific link leads to the profile of a particular group
- Malpedia (Equation Group): (https://malpedia.caad.fkie.fraunhofer.de/actor/equation_group) Malpedia is a collaborative platform for tracking malware families and threat actors. This specific link provides detailed information about the Equation Group, a highly sophisticated threat actor believed to be linked to the U.S. National Security Agency (NSA). It includes information on their malware, infrastructure, and known operations.
- MISP Galaxy (Tidal Groups): (https://misp-galaxy.org/tidal-groups) MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform. "Galaxies" within MISP are structured vocabularies for describing threat actors, malware, tools, and other related entities. This link leads to a galaxy focused on "Tidal Groups," which likely represents a specific set of threat actors or campaigns tracked within MISP.
- Operation Falcon (INTERPOL and Group-IB): (https://www.darkreading.com/cyberattacks-data-breaches/operation-falcon-interpol-and-group-ib-identify-nigerian-bec-ring-members) This is a news article from Dark Reading, reporting on "Operation Falcon," a joint operation between INTERPOL and Group-IB that targeted a Nigerian Business Email Compromise (BEC) ring. It provides details about the investigation, the arrests, and the scale of the BEC operation.
- The Silent Game (https://www.securityjoes.com/post/the-silent-game-sophisticated-threat-actors-targeting-gambling-industry): A report from Security Joes detailing a sophisticated threat actor campaign targeting the gambling industry. Provides technical details about the malware and TTPs used.
- Securelist - Crypt Ghouls (https://securelist.ru/crypt-ghouls-hacktivists-tools-overlap-analysis/110808/): An analysis by Kaspersky's Securelist of the "Crypt Ghouls" hacktivist group, including their tools, techniques, and potential overlaps with other threat actors.
- BlackEnergy (https://en.wikipedia.org/wiki/BlackEnergy): A Wikipedia article providing background information on BlackEnergy, a sophisticated malware toolkit used in several high-profile cyberattacks, including attacks against critical infrastructure in Ukraine.
- IPStorm (https://maldbg.com/ipstorm-golang-malware-windows): A blog post detailing the analysis of IPStorm, a Golang-based malware targeting Windows systems. The post covers its functionality, communication protocols, and persistence mechanisms.
- Equation Group (https://www.atlanticcouncil.org/blogs/natosource/inside-the-nsas-ultrasecret-hacking-group): An article from the Atlantic Council providing an overview of the Equation Group, including their capabilities, targets, and alleged connection to the NSA.
- Electrospaces - Nicknames and Codewords: (https://www.electrospaces.net/p/nicknames-and-codewords.html) A blog post compiling a list of nicknames and codewords used by intelligence agencies (primarily the NSA) and in cyber operations. This can help in understanding the context and attribution of certain attacks.
- Engineering Evil - Code Names: (https://engineeringevil.com/2016/07/26/exposed-code-names-and-operations-recent-and-in-progress) A blog post listing exposed code names and operations, both recent and in progress, related to cyber espionage and warfare. Similar to the Electrospaces link, it aids in understanding attribution and context.
- CFR Cyber Operations Tracker: (https://www.cfr.org/cyber-operations) A database maintained by the Council on Foreign Relations (CFR) that tracks publicly known state-sponsored cyber operations, providing information on the date, target, sponsor, and a brief description of each incident.
- Attack MITRE (https://attack.mitre.org/groups/G0067): Provides information on APT28.