search

MISP / misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)
https://misp-galaxy.org/
Other
509 stars 256 forks source link

[threat-actors] Add Alpha Spider #979

Closed Mathieu4141 closed 1 month ago

adulau commented 1 month ago

Just a quick question, is there a specific use-case to put the ransomware groups in the threat actor galaxy? compared to use the ransomware group cluster https://github.com/MISP/misp-galaxy/blob/main/clusters/ransomware.json#L24593 ?

r0ny123 commented 1 month ago

For me, yes. From an attribution perspective, It is required for tracking devs and affiliates separately.

adulau commented 1 month ago

FYI, We did a major update in the ransomware group galaxy cluster. It's now inline with the ransomlook.io dataset. Maybe in the future, for ransomware group, I would really prefer to use that galaxy cluster. On the other hand, if the TA can be dissociated from the ransomware group then it makes sense to have those as `threat-actor.

Mathieu4141 commented 1 month ago

Thanks for the review and context, will definitely take that into account next time!