ClickFix Threat Intelligence Threat Intelligence

Also note that Turla used OilRigs implants,https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html,http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/,http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/,http://www.clearskysec.com/oilrig/,https://cert.gov.il/Updates/Alerts/SiteAssets/CERT-IL-ALERT-W-120.pdf,http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/,http://blog.morphisec.com/iranian-fileless-cyberattack-on-israel-word-vulnerability%20,https://www.forbes.com/sites/thomasbrewster/2017/02/15/oilrig-iran-hackers-cyberespionage-us-turkey-saudi-arabia/#56749aa2468a,https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/,https://researchcenter.paloaltonetworks.com/2017/07/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/,https://researchcenter.paloaltonetworks.com/2017/09/unit42-striking-oil-closer-look-adversary-infrastructure/,https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html,https://researchcenter.paloaltonetworks.com/2017/12/unit42-introducing-the-adversary-playbook-first-up-oilrig/,https://www.dragos.com/blog/20180517Chrysene.html,https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf,https://sec0wn.blogspot.com/2018/05/prb-backdoor-fully-loaded-powershell.html,https://www.ncsc.gov.uk/news/turla-group-exploits-iran-apt-to-expand-coverage-of-victims,https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/,https://www.clearskysec.com/powdesk-apt34/,https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/,https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html,https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html,https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/,https://blog-cert.opmd.fr/dnspionage-retour-factuel-sur-les-attaques-annoncees-dans-differents-medias/,https://www.trendmicro.com/en_us/research/23/b/new-apt34-malware-targets-the-middle-east.html,https://www.trendmicro.com/en_no/research/23/i/apt34-deploys-phishing-attack-with-new-malware.html,https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/,,,,,, 20 Jun 2026

iran Reference

Iran Gov T1566

Que es Turla es un grupo de ciberataques asociado al país de Irán, conocido por su actividad de espionaje cyber y operaciones de ingeniería social. El grupo utiliza técnicas avanzadas para comprometer…

Iran3 minVer analisis →

Israeli-based organizations in the government 20 Jun 2026

middle-east Reference

Israel 🏛️ Government T1566

Que es Apt grupo regional Middle East se centra en sectores críticos como transporte, infraestructura, defensa y academia. Su actividad incluye ataques de spear phishing y operaciones cibernéticas rel…

Israel2 minVer analisis →

Earth Kapre 20 Jun 2026

unknown---unmapped-actors Reference

Australia T1566

Que es Earth Kapre (también conocido como RedCurl y Red Wolf) es un actor APT (Advanced Persistent Threat) del grupo regional Unknown / Unmapped Actors. Este grupo ha sido identificado como una organi…

Australia2 minVer analisis →

APTTrail: APT DESERTFALCON indicators and references 18 Jun 2026

apt-desertfalcon Ioc Unknown

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a APT DESERTFALCON. Aliases observados: APT DESERTFALCON. Conteo por tipo: domain: 23.Indicadores de Compromiso (IOCs)TipoValorContexto…

Unknown1 minVer analisis →

APTTrail: APT EARTHBERBEROKA indicators and references 18 Jun 2026

apt-earthberberoka Ioc Unknown

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a APT EARTHBERBEROKA. Aliases observados: APT EARTHBERBEROKA. Conteo por tipo: domain: 55, ipv4: 3.Indicadores de Compromiso (IOCs)Tipo…

Unknown1 minVer analisis →

APTTrail: APT EARTHHUNDUN indicators and references 18 Jun 2026

apt-earthhundun Ioc Unknown

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a APT EARTHHUNDUN. Aliases observados: APT EARTHHUNDUN. Conteo por tipo: domain: 7.Indicadores de Compromiso (IOCs)TipoValorContextoDom…

Unknown1 minVer analisis →

APTTrail: dinodas indicators and references 18 Jun 2026

dinodas Ioc Unknown 🏛️ Government

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a dinodas. Aliases observados: dinodas, dinodasrat, linodas, linodasrat. Conteo por tipo: domain: 12, ipv4: 7, url: 5.Indicadores de Co…

Unknown2 minVer analisis →

APTTrail: dmloader indicators and references 18 Jun 2026

dmloader Ioc Unknown

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a dmloader. Aliases observados: dmloader, dunloader, frpc, icmpinger, kmlog, krnrat, ladon, moriya, nbtscan, odriz, simpoboxspy, tesdat…

Unknown1 minVer analisis →

APTTrail: APT EARTHWENDIGO indicators and references 18 Jun 2026

apt-earthwendigo Ioc Unknown

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a APT EARTHWENDIGO. Aliases observados: APT EARTHWENDIGO. Conteo por tipo: domain: 4.Indicadores de Compromiso (IOCs)TipoValorContextoD…

Unknown1 minVer analisis →

APTTrail: famoussparrow indicators and references 18 Jun 2026

famoussparrow Ioc

China 💻 Tech

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a famoussparrow. Aliases observados: famoussparrow, keyboy, pirate panda, tropic trooper, usbferry. Conteo por tipo: domain: 90, ipv4: …

China1 minVer analisis →

APTTrail: exilerat indicators and references 18 Jun 2026

exilerat Ioc

India

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a exilerat. Aliases observados: exilerat, luckycat, sepulcher, shadownet, ta413. Conteo por tipo: domain: 56, ipv4: 8, url: 1.Indicador…

India1 minVer analisis →

APTTrail: clntend indicators and references 18 Jun 2026

clntend Ioc

Taiwan

Resumen APTTrailAPTTrail mantiene indicadores publicos asociados a clntend. Aliases observados: clntend, cxclnt, tidrone. Conteo por tipo: domain: 21, ipv4: 1.Indicadores de Compromiso (IOCs)TipoValor…

Taiwan2 minVer analisis →

BushidoUK RVM Profile: BlackCat 18 Jun 2026

blackcat Threat-actor

United Kingdom 📺 Media

Group Profile: BlackCatPerfil del grupo ransomware segun BushidoUK Ransomware Vulnerability Matrix. Incluye vulnerabilidades conocidas, herramientas y TTPs asociadas.BlackCat's Exploited Vulnerabiliti…

United Kingdom2 minVer analisis →

BushidoUK RVM Profile: DragonForce 18 Jun 2026

dragonforce Threat-actor

United Kingdom 📺 Media

Group Profile: DragonForcePerfil del grupo ransomware segun BushidoUK Ransomware Vulnerability Matrix. Incluye vulnerabilidades conocidas, herramientas y TTPs asociadas.DragonForce's Exploited Vulnera…

United Kingdom2 minVer analisis →

BushidoUK ToolMatrix ThreatIntel: ExtraThreatIntel 18 Jun 2026

bushidouk Report

United States

ThreatIntel: ExtraThreatIntel.mdRecurso del BushidoUK Ransomware Tool Matrix - ThreatIntel.Extra Threat Intel > [!IMPORTANT] > The Threat Groups mentioned in other files in this repository are highlig…

United States3 minVer analisis →

Actores mas activos

Paises con mas actividad

IOCs con relaciones