Missing malware reference.

[Th4nat0s]

Hello in v9 it seems that

malware--95e2cbae-d82c-4f7b-b63c-16462015d35d referenced in relation with intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542 is not existant.

{ "description": "(Citation: ESET Dukes October 2019)", "source_ref": "intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542", "external_references": [ { "description": "Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.", "source_name": "ESET Dukes October 2019", "url": "https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf" } ], "created": "2020-09-24T17:52:59.642Z", "relationship_type": "uses", "modified": "2020-10-09T16:08:00.729Z", "target_ref": "malware--95e2cbae-d82c-4f7b-b63c-16462015d35d", "object_marking_refs": [ "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168" ], "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5", "type": "relationship", "id": "relationship--69c5dbe2-438c-4f2c-8815-bae1f88a3d9f" },

[Th4nat0s]

In fact, i foudn 4 unlinked objects ERROR: malware--95e2cbae-d82c-4f7b-b63c-16462015d35d missing ERROR: malware--c19cfc89-5ac6-4d2d-a236-70d2b32e007c missing ERROR: malware--c41a8b7c-3e42-4eee-b87d-ad8a100ee878 missing ERROR: malware--a0d774e4-bafc-4292-8651-3ec899391341 missing

[isaisabel]

Hi @Th4nat0s,

Thank you for raising this issue! You are correct that all of these relationships are broken in some way. I'll summarize them below:

• intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542 => malware--95e2cbae-d82c-4f7b-b63c-16462015d35d
  • relationship--69c5dbe2-438c-4f2c-8815-bae1f88a3d9f
  • APT29 uses (an unpublished software)
  • malware--95e2cbae-d82c-4f7b-b63c-16462015d35d is a software we ended up not publishing, but for some reason this relationship got included anyway. It will most likely be removed.
• intrusion-set--049cef3b-22d5-4be6-b50c-9839c7a34fdd => malware--c19cfc89-5ac6-4d2d-a236-70d2b32e007c
  • relationship--7850d933-120b-4ae6-998d-8dc4dfd6d164
  • Bouncing Golf uses GolfSpy
  • Both Bouncing Golf and GolfSpy are mobile objects, so this relationship shouldn't be in enterprise at all. We also need to determine why Bouncing Golf is in Enterprise, since it appears to only be related to mobile techniques so it theoretically should only be in mobile, not both mobile and enterprise.
• intrusion-set--8a831aaa-f3e0-47a3-bed8-a9ced744dd12 => malware--c41a8b7c-3e42-4eee-b87d-ad8a100ee878
  • relationship--53364899-1ea5-47fa-afde-c210aed64120
  • Dark Caracal uses Pallas
  • Pallas is absent from enterprise because it has only mobile techniques
  • Dark Caracal is in both domains, so not sure why that relationship is in enterprise and not mobile. It should be in mobile, but it's in enterprise instead.
• intrusion-set--381fcf73-60f6-4ab2-9991-6af3cbc35192 => malware--a0d774e4-bafc-4292-8651-3ec899391341
  • relationship--df337ad4-c88e-425f-b869-ecac29674bf4
  • Sandworm Team uses CHEMISTGAMES
  • Sandworm Team is an enterprise only group
  • CHEMISTGAMES is a mobile only software
  • I don't think we have a precedent for how to handle cross-domain relationships when their source/targets are in completely different domains. In other cases of cross-domain objects (e.g Dark Caracal) the the object exists in both domains simultaneously.

So in summary, the first issue is from unpublished data, and the rest are issues to do with cross-domain objects. We'll look into the cause of the issues and rectify as needed.

[isaisabel]

All four relationship bugs have been fixed in eb1b9385d44340ce867a77358c5f5aaed666e54c.

[Th4nat0s]

Nice thank' you.