summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorW. Kosior <koszko@koszko.org>2024-12-16 19:41:24 +0100
committerW. Kosior <koszko@koszko.org>2024-12-16 19:41:24 +0100
commit973d4b6fc1232ae36b865f91204e8198233d5484 (patch)
tree98ddc1e2592ce0dafb9520bf4ca7d0aed3c15cdb
downloadAGH-threat-intel-course-973d4b6fc1232ae36b865f91204e8198233d5484.tar.gz
AGH-threat-intel-course-973d4b6fc1232ae36b865f91204e8198233d5484.zip
Initial commit.
-rw-r--r--Makefile45
-rw-r--r--profiles.yaml1588
-rw-r--r--scrape_groups_info.py127
-rwxr-xr-xthreats_by_sector_table.py88
4 files changed, 1848 insertions, 0 deletions
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..1cb2039
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,45 @@
+# SPDX-License-Identifier: CC0-1.0
+#
+# Copyright (C) 2024 Wojtek Kosior <koszko@koszko.org>
+
+# Make sure you have Pandoc, Python as well as Python packages `pyyaml' (YAML
+# parser library) and `requests' installed.
+
+PYTHON=python3
+PANDOC=pandoc
+
+all: tables.pdf scraped_group_aliases.yaml
+.PHONY: all
+
+.SUFFIXES: .pdf .md
+
+.md.pdf:
+ $(PANDOC) \
+ -V geometry:margin=1.10in \
+ -r markdown-auto_identifiers \
+ --number-sections \
+ --shift-heading-level-by=-1 \
+ --columns=1 \
+ -o $@ $<
+
+tables.md: threats_by_sector_table.py profiles.yaml
+ $(PYTHON) $^ > $@
+
+scraped_group_aliases.yaml: scrape_groups_info.py profiles.yaml
+ $(PYTHON) $^ > $@
+
+th-proj-archive.tar.gz: Makefile profiles.yaml scrape_groups_info.py \
+ scraped_group_aliases.yaml tables.md tables.pdf \
+ threats_by_sector_table.py
+ tar --transform='s|^|th-proj-archive/|' \
+ --mtime=1970-01-01T00:00:00-00:00 --group=0 --owner=0 \
+ -czf $@ $^
+
+clean:
+ rm -rf scraped_group_aliases.yaml tables.pdf tables.md \
+ th-proj-archive.tar.gz
+.PHONY: clean
+
+magisterclean: clean
+ rm -rf scraping/
+.PHONY: magisterclean
diff --git a/profiles.yaml b/profiles.yaml
new file mode 100644
index 0000000..b9759c4
--- /dev/null
+++ b/profiles.yaml
@@ -0,0 +1,1588 @@
+# SPDX-License-Identifier: CC0-1.0
+#
+# Copyright (C) 2024 Wojtek Kosior <koszko@koszko.org>
+---
+# "targets" are countries, groups thereof or regions of Earth. Only to most
+# often attacked ones are listed for each group. A country listed for one group
+# may overlap with a region listed (for example: for APT12 we have "Taiwan"
+# listed next to "East Asia
+groups:
+ - name: admin@338
+ origin: China
+ targets:
+ - where: HongKong
+ ref: china-based-threat
+ sectors:
+ - sector: defense
+ ref: rpt-poison-ivy
+ - sector: government
+ ref: rpt-poison-ivy
+ - sector: finance # "finance, economic and trade policy" in our source
+ ref: [rpt-poison-ivy, china-based-threat]
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: rpt-poison-ivy
+ - sector: media
+ ref: china-based-threat
+ goals:
+ - goal: espionage
+ ref: china-based-threat
+ references:
+ - label: rpt-poison-ivy
+ URL: https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
+ - label: china-based-threat
+ URL: https://cloud.google.com/blog/topics/threat-intelligence/china-based-threat/
+
+ - name: Agrius
+ origin: Iran
+ targets:
+ - where: Israel
+ ref: [evol-agrius, agrius-moneybird]
+ - where: Middle East
+ ref: evol-agrius
+ sectors:
+ - sector: education
+ ref: agrius-moneybird
+ - sector: insurance
+ ref: agrius-moneybird
+ goals:
+ - goal: espionage
+ ref: evol-agrius
+ - goal: disruption
+ ref: [evol-agrius, agrius-moneybird]
+ - goal: extortion
+ ref: [evol-agrius, agrius-moneybird]
+ references:
+ - label: evol-agrius
+ URL: https://assets.sentinelone.com/sentinellabs/evol-agrius
+ - label: agrius-moneybird
+ URL: https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/
+
+ - name: ALLANITE
+ origin: Russia
+ targets:
+ - where: US
+ ref: dragos-allanite
+ - where: UK
+ ref: dragos-allanite
+ sectors:
+ - sector: energy # "electric utility" in our source
+ ref: dragos-allanite
+ goals:
+ - goal: espionage
+ ref: dragos-allanite
+ - goal: disruption
+ ref: dragos-allanite
+ references:
+ - label: dragos-allanite
+ URL: https://www.dragos.com/threat/allanite/
+
+ - name: Aoqin Dragon
+ origin: China
+ targets:
+ - where: East Asia # "southeast Asia" in the source
+ ref: aoqin-newly-discovered
+ - where: Australia
+ ref: aoqin-newly-discovered
+ sectors:
+ - sector: government
+ ref: aoqin-newly-discovered
+ - sector: education
+ ref: aoqin-newly-discovered
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: aoqin-newly-discovered
+ goals:
+ - goal: espionage
+ ref: aoqin-newly-discovered
+ references:
+ - label: aoqin-newly-discovered
+ URL: https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/
+
+ - name: APT1
+ origin: China
+ targets:
+ - where: US
+ ref: mandiant-apt1-report
+ sectors:
+ - sector: information technology
+ ref: mandiant-apt1-report
+ - sector: aerospace
+ ref: mandiant-apt1-report
+ - sector: public administration
+ ref: mandiant-apt1-report
+ - sector: public administration
+ ref: mandiant-apt1-report
+ - sector: telecommunications/satellites
+ ref: mandiant-apt1-report
+ - sector: scientific research and consulting
+ ref: mandiant-apt1-report
+ - sector: energy
+ ref: mandiant-apt1-report
+ - sector: transportation
+ ref: mandiant-apt1-report
+ - sector: construction/manufacturing # "construction and manufacturing"
+ # in our source
+ ref: mandiant-apt1-report
+ - sector: non-government organizations # "international organizations" in
+ # our source
+ ref: mandiant-apt1-report
+ - sector: engineering services
+ ref: mandiant-apt1-report
+ - sector: electronics
+ ref: mandiant-apt1-report
+ - sector: legal services
+ ref: mandiant-apt1-report
+ - sector: media # "media, advertising and entertainment" in our source
+ ref: mandiant-apt1-report
+ - sector: navigation
+ ref: mandiant-apt1-report
+ goals:
+ - goal: espionage
+ ref: mandiant-apt1-report
+ references:
+ - label: mandiant-apt1-report
+ ref: https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf
+
+ - name: APT12
+ origin: China
+ targets:
+ - where: East Asia
+ ref: microtrends-ixeshe
+ - where: Taiwan
+ ref: microtrends-ixeshe
+ sectors:
+ - sector: electronics
+ ref: microtrends-ixeshe
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: microtrends-ixeshe
+ goals:
+ - goal: espionage
+ ref: mandiant-2014-report
+ references:
+ - label: mandiant-2014-report
+ URL: https://web.archive.org/web/20140913050920/https://dl.mandiant.com/EE/library/WP_M-Trends2014_140409.pdf
+ - label: microtrends-ixeshe # uses name "IXESHE" rather than "APT12"
+ URL: https://web.archive.org/web/20190808160128/https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf
+
+ - name: APT16
+ origin: China
+ targets:
+ - where: Taiwan
+ ref: the-eps-awakens
+ sectors:
+ # The source mentions more attacks but doesn't attribute them with
+ # certainty to APT16.
+ - sector: media # "media and entertainment" in our source
+ ref: the-eps-awakens
+ goals:
+ - goal: espionage
+ references:
+ - label: the-eps-awakens
+ URL: https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html
+
+ - name: APT17
+ origin: China
+ targets:
+ - where: US
+ ref: apt17-report
+ sectors:
+ - sector: government
+ ref: apt17-report
+ - sector: defense
+ ref: apt17-report
+ - sector: information technology
+ ref: apt17-report
+ - sector: legal services # "law firms" in our source
+ ref: apt17-report
+ - sector: mining
+ ref: apt17-report
+ - sector: non-government organizations
+ ref: apt17-report
+ # No goals were explicitly named in our source.
+ references:
+ - label: apt17-report
+ URL: https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf
+
+ - name: APT18
+ origin: China
+ targets:
+ - where: US
+ ref: bugcrowd-apt18
+ sectors:
+ # Besides the ones below, our source also mentions "technology" and "high
+ # technology" which are to broad/ambigious for us to use here.
+ - sector: construction/manufacturing
+ ref: bugcrowd-apt18
+ - sector: government
+ ref: bugcrowd-apt18
+ - sector: medical # "healthcare" in our source
+ ref: bugcrowd-apt18
+ - sector: defense
+ ref: bugcrowd-apt18
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: bugcrowd-apt18
+ - sector: non-government organizations # "human rights groups" and
+ # "non-profit" in our source
+ ref: bugcrowd-apt18
+ - sector: engineering services # "engineering" in our source
+ ref: bugcrowd-apt18
+ - sector: energy
+ ref: bugcrowd-apt18
+ - sector: education
+ ref: bugcrowd-apt18
+ - sector: aerospace
+ ref: bugcrowd-apt18
+ - sector: transportation
+ ref: bugcrowd-apt18
+ - sector: biotechnology
+ ref: bugcrowd-apt18
+ goals:
+ - goal: espionage
+ ref: bugcrowd-apt18
+ references:
+ - label: bugcrowd-apt18
+ URL: https://www.bugcrowd.com/glossary/apt18/
+
+ - name: APT19
+ origin: China
+ targets:
+ - where: US # Forbes is an American magazine.
+ ref: darkreading-codoso-team
+ - where: Hong Kong # Forbes is also owned b a Hong Kong-based group.
+ ref: darkreading-codoso-team
+ sectors:
+ - sector: legal services # "legal" in our source
+ ref: fireeye-apt-groups
+ - sector: finance # "investment" in our source
+ ref: [fireeye-apt-groups, darkreading-codoso-team]
+ - sector: defense
+ ref: darkreading-codoso-team
+ - sector: dissident groups
+ ref: darkreading-codoso-team
+ - sector: medical # "pharmaceutical" in our source
+ ref: darkreading-codoso-team
+ - sector: energy
+ ref: darkreading-codoso-team
+ goals:
+ - goal: espionage
+ ref: darkreading-codoso-team
+ references:
+ - label: darkreading-codoso-team
+ URL: https://www.darkreading.com/cyberattacks-data-breaches/chinese-hacking-group-codoso-team-uses-forbes-com-as-watering-hole
+
+ - name: APT28
+ origin: Russia
+ targets:
+ - where: US
+ ref: mandiant-apt28
+ - where: Europe
+ ref: [fireeye-apt-groups, mandiant-apt28]
+ - where: NATO
+ ref: fireeye-apt-groups
+ - where: former Soviet Union # "Caucasus" and "eastern European countries"
+ # in `fireeye-apt-groups'
+ ref: [fireeye-apt-groups, mandiant-apt28]
+ - where: Georgia
+ ref: fireeye-apt-groups
+ sectors:
+ - sector: defense # "militaries", "security organizations" and "defense
+ # firms" in our source
+ ref: fireeye-apt-groups
+ - sector: government
+ ref: mandiant-apt28
+ - sector: dissident groups
+ ref: mandiant-apt28
+ - sector: religious groups
+ ref: mandiant-apt28
+ - sector: sport # the World Anti-Doping Agency
+ ref: mandiant-apt28
+ goals:
+ - goal: espionage
+ ref: mandiant-apt28
+ references:
+ - label: mandiant-apt28
+ URL: https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf
+
+ - name: APT29
+ origin: Russia
+ targets:
+ - where: US
+ ref: [eset-operation-ghost-dukes, cyber-case-study-solarwinds]
+ - where: Norway
+ ref: eset-operation-ghost-dukes
+ - where: Europe # 3 EU ministries and a Washington DC embassy
+ ref: eset-operation-ghost-dukes
+ sectors:
+ - sector: government
+ ref: eset-operation-ghost-dukes
+ - sector: drug dealers # a reuse of hacking tools…
+ ref: eset-operation-ghost-dukes
+ goals:
+ - goal: espionage
+ ref: [eset-operation-ghost-dukes, cyber-case-study-solarwinds]
+ references:
+ - label: eset-operation-ghost-dukes
+ URL: https://web-assets.esetstatic.com/wls/2019/10/ESET_Operation_Ghost_Dukes.pdf
+ - label: cyber-case-study-solarwinds
+ URL: https://ollisakersarney.com/wp-content/uploads/2021/10/Cyber_Case_Study_-_SolarWinds_Supply_Chain_Cyberattack.pdf
+
+ - name: APT3
+ origin: China
+ targets:
+ - where: US
+ ref: chinas-cyber-capabilities
+ - where: Germany # Siemens AG is a German company
+ ref: chinas-cyber-capabilities
+ sectors:
+ - sector: information technology
+ ref: chinas-cyber-capabilities
+ - sector: aerospace
+ ref: fireeye-apt-groups
+ - sector: defense
+ ref: fireeye-apt-groups
+ - sector: construction/manufacturing # "construction and engineering" in
+ # our source
+ ref: fireeye-apt-groups
+ - sector: telecommunications/satellites
+ ref: [fireeye-apt-groups, chinas-cyber-capabilities]
+ goals:
+ - goal: espionage
+ ref: chinas-cyber-capabilities
+ references:
+ - label: chinas-cyber-capabilities
+ URL: https://www.uscc.gov/sites/default/files/2022-11/Chapter_3_Section_2--Chinas_Cyber_Capabilities.pdf
+
+ - name: APT30
+ origin: China
+ targets:
+ - where: East Asia # Association of Southeast Asian Nations in our source
+ ref: fireeye-apt-groups
+ sectors:
+ - sector: government
+ ref: fireeye-apt30
+ - sector: media
+ ref: fireeye-apt30
+ goals:
+ - goal: espionage
+ ref: fireeye-apt30
+ references:
+ - label: fireeye-apt30
+ URL: https://scadahacker.com/library/Documents/Cyber_Events/Fireeye%20-%20APT30.pdf
+
+ - name: APT33
+ origin: Iran
+ sectors:
+ - sector: aerospace # "aviation" in `hivepro-apt33'
+ ref: [fireeye-apt-groups, hivepro-apt33]
+ - sector: energy
+ ref: [fireeye-apt-groups, hivepro-apt33]
+ - sector: construction/manufacturing # only "construction" in our source
+ ref: hivepro-apt33
+ - sector: defense
+ ref: hivepro-apt33
+ - sector: education
+ ref: hivepro-apt33
+ - sector: finance
+ ref: hivepro-apt33
+ - sector: medical # "healthcare" and "pharmaceutical" in our source
+ ref: hivepro-apt33
+ - sector: government
+ ref: hivepro-apt33
+ - sector: telecommunications/satellites
+ ref: hivepro-apt33
+ goals:
+ - goal: espionage
+ ref: hivepro-apt33
+ references:
+ - label: hivepro-apt33
+ URL: https://www.hivepro.com/wp-content/uploads/2023/09/APT-33-Uses-Password-Spray-Campaigns-to-Infiltrate-Organizations_TA2023375.pdf
+
+ - name: APT39
+ origin: Iran
+ targets:
+ - where: US
+ ref: fireeye-apt39
+ - where: Middle East
+ ref: fireeye-apt39
+ sectors:
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: fireeye-apt39
+ - sector: travel
+ ref: fireeye-apt39
+ - sector: government
+ ref: fireeye-apt39
+ goals:
+ - goal: espionage
+ ref: fireeye-apt39
+ references:
+ - label: fireeye-apt39
+ URL: https://attack.mitre.org/docs/training-cti/FireEye%20APT39%20-%20original%20report.pdf
+
+ - name: APT41
+ origin: China
+ targets:
+ - where: East Asia
+ ref: rt-apt41-dual-operation
+ - where: US
+ ref: rt-apt41-dual-operation
+ - where: India
+ ref: rt-apt41-dual-operation
+ - where: Europe
+ ref: rt-apt41-dual-operation
+ - where: South Africa
+ ref: rt-apt41-dual-operation
+ sectors:
+ - sector: medical
+ ref: rt-apt41-dual-operation
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: rt-apt41-dual-operation
+ - sector: education
+ ref: rt-apt41-dual-operation
+ - sector: travel
+ ref: rt-apt41-dual-operation
+ - sector: media
+ ref: rt-apt41-dual-operation
+ - sector: video games
+ ref: rt-apt41-dual-operation
+ - sector: information technology
+ ref: rt-apt41-dual-operation
+ - sector: retail
+ ref: rt-apt41-dual-operation
+ - sector: virtual currencies
+ ref: rt-apt41-dual-operation
+ goals:
+ - goal: rt-apt41-dual-operation
+ ref: expionage
+ - goal: rt-apt41-dual-operation
+ ref: financial theft
+ references:
+ - label: rt-apt41-dual-operation
+ URL: https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf
+
+ # Going alphabetically, now we'd have APT5. It's been omitted because neither
+ # the NSA'a Threat Hunting Guidance[1] nor the description from
+ # ^[fireeye-apt-groups] actually state its origin. Some sources call it a
+ # Chinese group but those can be considered less reliable than these 2.
+
+ - name: Aquatic Panda
+ origin: China
+ sectors:
+ - sector: education
+ ref: overwatch-exposes-aquatic-panda
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: overwatch-exposes-aquatic-panda
+ - sector: government
+ ref: overwatch-exposes-aquatic-panda
+ goals:
+ - goal: espionage
+ ref: overwatch-exposes-aquatic-panda
+ references:
+ - label: overwatch-exposes-aquatic-panda
+ URL: https://www.crowdstrike.com/en-us/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
+
+ - name: Axiom
+ origin: China
+ targets:
+ - where: Europe
+ ref: novetta-executive-summary
+ - where: East Asia
+ ref: novetta-executive-summary
+ - where: US
+ ref: novetta-executive-summary
+ sectors:
+ - sector: media # "journalists" in our source
+ ref: novetta-executive-summary
+ - sector: information technology # "software companies" in our source
+ ref: novetta-executive-summary
+ - sector: education
+ ref: novetta-executive-summary
+ - sector: government
+ ref: novetta-executive-summary
+ - sector: telecommunications
+ ref: novetta-executive-summary
+ - sector: non-government organizations
+ ref: novetta-executive-summary
+ goals:
+ - goal: espionage
+ ref: novetta-executive-summary
+ references:
+ - label: novetta-executive-summary
+ URL: https://web.archive.org/web/20230211014413/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
+
+ - name: BackdoorDiplomacy
+ origin: China
+ targets:
+ - where: Middle East
+ ref: bitdefender-backdoordiplomacy
+ - where: Europe
+ ref: hivepro-backdoordiplomacy
+ - where: South Africa
+ ref: hivepro-backdoordiplomacy
+ - where: Namibia
+ ref: hivepro-backdoordiplomacy
+ - where: South Asia
+ ref: hivepro-backdoordiplomacy
+ sectors:
+ - sector: government
+ ref: hivepro-backdoordiplomacy
+ - sector: telecommunications/satellites # only "telecommunications" in our
+ # source
+ ref: hivepro-backdoordiplomacy
+ goals:
+ - goal: espionage
+ ref: bitdefender-backdoordiplomacy
+ references:
+ - label: bitdefender-backdoordiplomacy
+ URL: https://www.bitdefender.com/files/News/CaseStudies/study/426/Bitdefender-PR-Whitepaper-BackdoorDiplomacy-creat6507-en-EN.pdf
+ - label: hivepro-backdoordiplomacy
+ URL: https://www.hivepro.com/wp-content/uploads/2022/12/BackdoorDiplomacy-targets-the-telecom-industry-in-the-Middle-East_TA2022285.pdf
+
+ - name: BlackTech
+ origin: China
+ targets:
+ - where: East Asia
+ ref: nnt-blacktech
+ - where: US
+ ref: nnt-blacktech
+
+ goals:
+ - goal: espionage
+ ref: nnt-blacktech
+ references:
+ - label: csa-blacktech
+ URL: https://media.defense.gov/2023/Sep/27/2003309107/-1/-1/0/CSA_BLACKTECH_HIDE_IN_ROUTERS_TLP-CLEAR.PDF
+ - label: nnt-blacktech
+ URL: https://jp.security.ntt/resources/EN-BlackTech_2021.pdf
+
+ - name: BRONZE BUTLER
+ origin: China
+ targets:
+ - where: Japan
+ ref: butler-targets-japanese
+ sectors:
+ - sector: government
+ ref: hivepro-butler
+ - sector: defense
+ ref: hivepro-butler
+ goals:
+ - goal: espionage
+ ref: butler-targets-japanese
+ references:
+ - label: butler-targets-japanese
+ URL: https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
+ - label: hivepro-butler
+ URL: https://www.hivepro.com/wp-content/uploads/2023/03/TA2023135.pdf
+
+ - name: Chimera
+ origin: China
+ targets:
+ - where: Taiwan
+ ref: cycraft-chimera
+ sectors:
+ - sector: electronics
+ ref: cycraft-chimera
+ goals:
+ - goal: espionage
+ ref: cycraft-chimera
+ references:
+ - label: cycraft-chimera
+ URL: https://uploads-ssl.webflow.com/6667e1c7aa0aa53cf61a022c/66bc65e430aa86747891a088_%5BTLP-White%5D20200415%20Chimera_V4.2.pdf
+
+ - name: Cinnamon Tempest
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Cleaver
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: CopyKittens
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: CURIUM
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: CyberAv3ngers
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Daggerfly
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Deep Panda
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Dragonfly
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: DragonOK
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Earth Lusca
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Elderwood
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Ember Bear
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Ferocious Kittens
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+
+ - name: Fox Kitten
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Gallium
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Gamaredon Group
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: HAFNIUM
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: IndigoZebra
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Indrik Spider
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Ke3chang
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Lazarus Group
+ origin: North Korea
+ targets:
+ - where: South Korea
+ ref: trendmicro-lazarus
+ - where: US
+ ref: trendmicro-lazarus
+ - where: Vietnam
+ ref: trendmicro-lazarus
+ sectors:
+ - sector: government
+ ref: trendmicro-lazarus
+ - sector: finance
+ ref: trendmicro-lazarus
+ - sector: media
+ ref: trendmicro-lazarus
+ - sector: defense
+ ref: trendmicro-lazarus
+ goals:
+ - goal: espionage
+ ref: trendmicro-lazarus
+ - goal: disruption
+ ref: trendmicro-lazarus
+ - goal: extortion
+ ref: trendmicro-lazarus
+ - goal: financial theft
+ ref: trendmicro-lazarus
+ references:
+ - label: trendmicro-lazarus
+ URL: https://www.trendmicro.com/vinfo/nl/security/news/cybercrime-and-digital-threats/a-look-into-the-lazarus-groups-operations
+
+ - name: Leafminer
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Leviathan
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Lotus Blossom
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Magic Hound
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: menuPass
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Moafee
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Mofang
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Moonstone Sleet
+ origin: North Korea
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Moses Staff
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: MuddyWater
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Mustang Panda
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Naikon
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Nomadic Octopus
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: OilRig
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: PittyTiger
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Putter Panda
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Saint Bear
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Sandworm Team
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Silent Librarian
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Star Blizzard
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Suckfly
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Threat Group-3390
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Tonto Team
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Tropic Trooper
+ origin: China # mitre.org calls it unaffiliated but at least one of the
+ # sources calls it "China-backed" and its set of targets is
+ # consistent with that of other Chinese APTs.
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Turla
+ origin: Russia
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: UNC788
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Volt Typhoon
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Windshift
+ origin: Iran
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ - name: Winnti Group
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+ # Going alphabetically, now we'd have Winter Vivern. It's been omitted
+ # because there is no clue as to whether it is actually a Russian group or a
+ # Belorussian one.
+
+ - name: ZIRCONIUM
+ origin: China
+ # targets:
+ # - where:
+ # ref:
+ # - where:
+ # ref:
+ # sectors:
+ # - sector:
+ # ref:
+ # - sector:
+ # ref:
+ # goals:
+ # - goal:
+ # ref:
+ # references:
+ # - label:
+ # URL:
+
+# Below we keep references that are used in profiles of multiple groups.
+references:
+ label: fireeye-apt-groups
+ URL: https://web.archive.org/web/20180806122230/https://www.fireeye.com/current-threats/apt-groups.html#apt19
diff --git a/scrape_groups_info.py b/scrape_groups_info.py
new file mode 100644
index 0000000..549f872
--- /dev/null
+++ b/scrape_groups_info.py
@@ -0,0 +1,127 @@
+#!/usr/bin/env python3
+
+# SPDX-License-Identifier: CC0-1.0
+#
+# Copyright (C) 2024 Wojtek Kosior <koszko@koszko.org>
+
+from dataclasses import dataclass
+from html.parser import HTMLParser
+from pathlib import Path
+import sys
+
+import requests
+import yaml
+
+mitre_pages_path = Path(".") / "scraping" / "attack.mitre.org"
+profiles_path = Path('./profiles.yaml')
+
+def mitre_page_download(path):
+ response = requests.get('https://attack.mitre.org/' + path)
+ response.raise_for_status()
+ return response.text
+
+def mitre_page_get(path):
+ page_path = mitre_pages_path / path
+ if page_path.exists():
+ return page_path.read_text()
+ else:
+ if not page_path.parent.exists():
+ page_path.parent.mkdir(parents=True)
+ page_text = mitre_page_download(path)
+ page_path.write_text(page_text)
+ return page_text
+
+@dataclass
+class Group:
+ name: str
+ mitre_id: str
+ aliases: list[str]
+
+
+
+class GroupListPageParser(HTMLParser):
+ def __init__(self, relevant_groups):
+ super().__init__()
+ self.relevant_groups = relevant_groups
+
+ self.col_numbers = [-1]
+ self.current_tags = ["*TOP*"]
+
+ self.collected_groups = {}
+
+ self.collecting_new_group()
+
+ def collecting_new_group(self):
+ self.current_group_mitre_id = None
+ self.current_group_name = None
+ self.current_group_aliases = None
+
+ def handle_starttag(self, tag, attrs):
+ self.current_tags.append(tag)
+
+ if tag == "tr":
+ self.col_numbers.append(-1)
+ elif tag == "td":
+ self.col_numbers[-1] += 1
+
+ def handle_data(self, data):
+ if self.current_tags[-1] == "a" and self.col_numbers[-1] == 0:
+ self.current_group_mitre_id = data.strip()
+ elif self.current_tags[-1] == "a" and self.col_numbers[-1] == 1:
+ self.current_group_name = data.strip()
+ elif self.current_tags[-1] == "td" and self.col_numbers[-1] == 2:
+ data = data.strip()
+ if data:
+ self.current_group_aliases = data.split(", ")
+ else:
+ self.current_group_aliases = []
+
+ def handle_endtag(self, tag):
+ self.current_tags.pop()
+
+ if tag == "tr":
+ self.col_numbers.pop()
+
+ if self.current_group_name is None or \
+ self.current_group_mitre_id is None or \
+ self.current_group_aliases is None:
+ print("Incomplete data for group.", file=sys.stderr)
+ return
+
+ if self.current_group_name not in self.relevant_groups:
+ print(f"Ignoring group `{self.current_group_name}'",
+ file=sys.stderr)
+ return
+
+ if self.current_group_name in self.collected_groups:
+ print(f"Double definition of group `{self.current_group_name}'",
+ file=sys.stderr)
+ return
+
+ self.collected_groups[self.current_group_name] = Group(
+ self.current_group_name,
+ self.current_group_mitre_id,
+ self.current_group_aliases
+ )
+
+ self.collecting_new_group()
+
+def get_groups(names):
+ parser = GroupListPageParser(names)
+ parser.feed(mitre_page_get("groups/"))
+ return parser.collected_groups
+
+def get_group_names(profiles_path):
+ def group_names(inp):
+ return {group["name"] for group in yaml.safe_load(inp)["groups"]}
+
+ if profiles_path:
+ with open(profiles_path) as inp:
+ return group_names(inp)
+
+ return group_names(sys.stdin)
+
+if __name__ == "__main__":
+ group_names = get_group_names(None if len(sys.argv) < 2 else sys.argv[1])
+ groups = get_groups(group_names)
+ yaml.safe_dump([group.__dict__ for group in groups.values()], sys.stdout)
diff --git a/threats_by_sector_table.py b/threats_by_sector_table.py
new file mode 100755
index 0000000..597cf12
--- /dev/null
+++ b/threats_by_sector_table.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+
+# SPDX-License-Identifier: CC0-1.0
+#
+# Copyright (C) 2024 Wojtek Kosior <koszko@koszko.org>
+
+import yaml
+import sys
+
+def read_APT_data(yaml_path):
+ if yaml_path:
+ with open(yaml_path) as inp:
+ return yaml.safe_load(inp)
+ else:
+ return yaml.safe_load(sys.stdin)
+
+def group_has_sector(group, sector):
+ group_sectors = group.get("sectors", [])
+
+ if sector is None:
+ return not group_sectors
+
+ for sector_obj in group_sectors:
+ if sector_obj["sector"] == sector:
+ return True
+
+def group_has_goal(group, goal):
+ group_goals = group.get("goals", [])
+
+ if goal is None:
+ return not group_goals
+
+ for goal_obj in group_goals:
+ if goal_obj["goal"] == goal:
+ return True
+
+dashes = ''.join('-' for _ in range(24))
+
+def print_tables(APT_data, out=sys.stdout):
+ all_groups = APT_data["groups"]
+ all_goals = sorted({goal["goal"]
+ for group in all_groups
+ for goal in group.get("goals", [])})
+ all_origins = sorted({group["origin"] for group in all_groups})
+ all_sectors = sorted({sector["sector"]
+ for group in all_groups
+ for sector in group.get("sectors", [])})
+
+ separator_line = f"|{'|'.join(dashes for _ in [None] + all_origins)}|"
+
+ first = True
+
+ for sector in all_sectors:
+ if first:
+ first = False
+ else:
+ print("\\newpage")
+
+ groups = [group for group in all_groups
+ if group_has_sector(group, sector)]
+
+ def make_group_listing(origin, goal):
+ return ", ".join(group["name"] for group in groups
+ if (group["origin"] == origin and
+ group_has_goal(group, goal)))
+
+ print(f"### {sector}")
+ print()
+ print(f"|**goal &#92; origin**|**{'**|**'.join(all_origins)}**|")
+
+ for goal in all_goals:
+ group_listings = [make_group_listing(origin, goal) or ' '
+ for origin in all_origins]
+ print(separator_line)
+ print(f"|**{goal}**|{'|'.join(group_listings)}|")
+
+ # Groups with no documented goal (if there are such ones)
+ group_listings = [make_group_listing(origin, None)
+ for origin in all_origins]
+
+ if any(group_listings):
+ print(separator_line)
+ print(f"|*not documented*|{'|'.join(group_listings)}|")
+
+ print()
+
+if __name__ == "__main__":
+ print_tables(read_APT_data(None if len(sys.argv) < 2 else sys.argv[1]))