Turla and APT26 share the same synonym

MISP / misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)

https://misp-galaxy.org/

Other

509 stars 256 forks source link

Turla and APT26 share the same synonym #942

Closed frenkiesp closed 4 months ago

frenkiesp commented 4 months ago

Hello, We noticed that the threat actors Turla and APT26 share the same alias/synonym "Hippo Team". How is this possible? Is this a mistake? Thanks. Francesco

adulau commented 4 months ago

Interesting. I’ll do a review. Thanks for the notification.

adulau commented 4 months ago

Thanks for the notification, it's now fixed.

frenkiesp commented 4 months ago

Hi Alexandre, thanks for the fix. We found other six cases that have this issue. I attached a CSV file misp_shared_aliases.csv

Tanks a lot, Francesco

adulau commented 4 months ago

Thanks for the CSV and I just quickly reviewed those:

[ ] PLA Navy is more the sponsoring organisation. We should move it in a meta on the three clusters like sponsor-organisation
[X] Grizzly Steppe is correct to be a synonym for APT28 and APT29
[X] Andariel is a sub-group of Lazarous group
[X] Cobalt Gypsy seems to be correct as it's historical with a discovery of multiple IR-sponsored groups
[X] Golden Chickens seems to be a generic group to describe group 01 and 02 globally