{ "type": "Domain", "indicator": "mozilla-plugins.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/mozilla-plugins.com", "alexa": "http://www.alexa.com/siteinfo/mozilla-plugins.com", "indicator": "mozilla-plugins.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 212193, "indicator": "mozilla-plugins.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "5c73a72a027c1b7031f26b36", "name": "Threat Campaign Likely Targeting NATO Members, Defense and Military Outlets", "description": "Word document found in the wild that is likely associated with the SNAKEMACKEREL (APT28/Sofacy/Fancy Bear) threat group. iDefense assesses with moderate confidence that the actors may be targeting attendees and sponsors of the upcoming\nUnderwater Defence & Security 2019 event occurring March 5-7, 2019, in Southampton, United\nKingdom. This event draws attendees from government, military and private sector entities across the globe, allowing this global event to represent a unique opportunity for SNAKEMACKEREL actors to conduct targeted intrusion operations against a wide array of organizations falling under its collection requirements.", "modified": "2020-11-13T00:00:32.402000", "created": "2019-02-25T08:28:26.206000", "tags": [ "sofacy", "russia", "gru", "apt28", "fancy bear" ], "references": [ "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf", "https://twitter.com/kyleehmke/status/1171111104149368836" ], "public": 1, "adversary": "Sofacy", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Military", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 194, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "URL": 2, "FileHash-SHA256": 5, "hostname": 24, "FileHash-MD5": 2, "FileHash-SHA1": 1, "domain": 149, "email": 20 }, "indicator_count": 203, "is_author": false, "is_subscribing": null, "subscriber_count": 376790, "modified_text": "1979 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "56bf1ccd67db8c71b90741d5", "name": "A Look Into Fysbis: Sofacy\u2019s Linux Backdoor", "description": "The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia. Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments. \nFrom these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems \u2013 Windows, OSX, Linux, even mobile iOS.", "modified": "2017-08-23T14:11:14.299000", "created": "2016-02-13T12:08:45.919000", "tags": [ "Sofacy", "apt28", "sednit", "linux", "Fysbis", "backdoor", "unit42", "russia" ], "references": [ "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor" ], "public": 1, "adversary": "Sofacy", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 54, "upvotes_count": 4.0, "downvotes_count": 1.0, "votes_count": 3.0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "domain": 3, "FileHash-MD5": 3, "YARA": 2 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 376755, "modified_text": "3156 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://twitter.com/kyleehmke/status/1171111104149368836", "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor", "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf" ], "related": { "alienvault": { "adversary": [ "Sofacy" ], "malware_families": [], "industries": [ "Military", "Government" ] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "5c73a72a027c1b7031f26b36", "name": "Threat Campaign Likely Targeting NATO Members, Defense and Military Outlets", "description": "Word document found in the wild that is likely associated with the SNAKEMACKEREL (APT28/Sofacy/Fancy Bear) threat group. iDefense assesses with moderate confidence that the actors may be targeting attendees and sponsors of the upcoming\nUnderwater Defence & Security 2019 event occurring March 5-7, 2019, in Southampton, United\nKingdom. This event draws attendees from government, military and private sector entities across the globe, allowing this global event to represent a unique opportunity for SNAKEMACKEREL actors to conduct targeted intrusion operations against a wide array of organizations falling under its collection requirements.", "modified": "2020-11-13T00:00:32.402000", "created": "2019-02-25T08:28:26.206000", "tags": [ "sofacy", "russia", "gru", "apt28", "fancy bear" ], "references": [ "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf", "https://twitter.com/kyleehmke/status/1171111104149368836" ], "public": 1, "adversary": "Sofacy", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Military", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 194, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "URL": 2, "FileHash-SHA256": 5, "hostname": 24, "FileHash-MD5": 2, "FileHash-SHA1": 1, "domain": 149, "email": 20 }, "indicator_count": 203, "is_author": false, "is_subscribing": null, "subscriber_count": 376790, "modified_text": "1979 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "56bf1ccd67db8c71b90741d5", "name": "A Look Into Fysbis: Sofacy\u2019s Linux Backdoor", "description": "The Sofacy group, also known as APT28 and Sednit, is a fairly well known cyber espionage group believed to have ties to Russia. Their targets have spanned all across the world, with a focus on government, defense organizations and various Eastern European governments. \nFrom these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems \u2013 Windows, OSX, Linux, even mobile iOS.", "modified": "2017-08-23T14:11:14.299000", "created": "2016-02-13T12:08:45.919000", "tags": [ "Sofacy", "apt28", "sednit", "linux", "Fysbis", "backdoor", "unit42", "russia" ], "references": [ "http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor" ], "public": 1, "adversary": "Sofacy", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 54, "upvotes_count": 4.0, "downvotes_count": 1.0, "votes_count": 3.0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3, "domain": 3, "FileHash-MD5": 3, "YARA": 2 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 376755, "modified_text": "3156 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "mozilla-plugins.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "mozilla-plugins.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776222480.1608176 }