2020-06-05 CrowdStrike’s work with the Democratic National Committee Setting the record straight

📃Title: CrowdStrike’s work with the Democratic National Committee: Setting the record straight
📅Date: 2020-06-05
🔗References:

• https://www.crowdstrike.com/en-us/blog/bears-midst-intrusion-democratic-national-committee/

🔖Rectifyq Taxonomies:

• relevancy: 🔴 Highly Relevant
• category: ⚔Threat
• sub-category: intrusion-analysis
• target: targeted
• MY-relevancy: relevant

🔖MISP Galaxies:

• producer= CrowdStrike
• target-information=“Brazil”
• target-information=“Canada”
• target-information=“China”
• target-information=“Georgia”
• target-information=“Iran”
• target-information=“Japan”
• target-information=“Malaysia”
• target-information=“South Korea”
• threat-actor= APT28
• threat-actor= APT29
• malpedia=“SEADADDY”
• malpedia=“X-Tunnel (.NET)”
• malpedia=“XTunnel”
• mitre-attack-pattern=[]

MISP event uuid: 76d18fbe-0d66-412d-90f6-6e1d9f6d7dbe

Indicator of Compromise (IoCs)

type,value,comment
md5, 004b55a66b3a86a1ce0a0b9b69b95976, 'pagemgr.exe (SeaDaddy implant)'
md5, ce227ae503e166b77bf46b6c8f5ee4da, 'pagemgr.exe (SeaDaddy implant)'
md5, cc9e6578a47182a941a478b276320e06, 'twain_64.dll (64-bit X-Agent implant)'
md5, 9e7053a4b6c9081220a694ec93211b4e, 'VmUpgradeHelper.exe (X-Tunnel implant)'
md5, 19172b9210295518ca52e93a29cfe8f4, 'VmUpgradeHelper.exe (X-Tunnel implant)'

Full IOCs available in Rectifyq’s MISP