adpare
59 lines
3.0 KiB
JSON
59 lines
3.0 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--58499b03-d2c0-4057-ab6e-8cb4d7177033",
|
|
"spec_version": "2.0",
|
|
"objects": [
|
|
{
|
|
"modified": "2024-11-20T23:33:20.890Z",
|
|
"name": "FrostyGoop",
|
|
"description": "[FrostyGoop](https://attack.mitre.org/software/S1165) is a Windows-based binary written in Golang that allows for interaction with industrial control system (ICS) equipment via Modbus TCP over port 502. [FrostyGoop](https://attack.mitre.org/software/S1165) allows for reading and writing data to holding registers on targeted devices, manipulating the operation of systems for malicious purposes. [FrostyGoop](https://attack.mitre.org/software/S1165) is associated with the [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) in Ukraine.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)",
|
|
"x_mitre_platforms": [
|
|
"Control Server",
|
|
"Field Controller/RTU/PLC/IED"
|
|
],
|
|
"x_mitre_deprecated": false,
|
|
"x_mitre_domains": [
|
|
"ics-attack"
|
|
],
|
|
"x_mitre_version": "1.0",
|
|
"x_mitre_aliases": [
|
|
"FrostyGoop",
|
|
"BUSTLEBERM"
|
|
],
|
|
"type": "malware",
|
|
"id": "malware--b34df04a-9d30-4d84-a03f-0d536ee19a05",
|
|
"created": "2024-11-20T23:02:16.588Z",
|
|
"created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"revoked": false,
|
|
"external_references": [
|
|
{
|
|
"source_name": "mitre-attack",
|
|
"url": "https://attack.mitre.org/software/S1165",
|
|
"external_id": "S1165"
|
|
},
|
|
{
|
|
"source_name": "BUSTLEBERM",
|
|
"description": "(Citation: Nozomi BUSTLEBERM 2024)"
|
|
},
|
|
{
|
|
"source_name": "Dragos FROSTYGOOP 2024",
|
|
"description": "Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.",
|
|
"url": "https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"
|
|
},
|
|
{
|
|
"source_name": "Nozomi BUSTLEBERM 2024",
|
|
"description": "Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.",
|
|
"url": "https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"
|
|
}
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
|
|
],
|
|
"x_mitre_attack_spec_version": "3.2.0",
|
|
"x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
|
|
"labels": [
|
|
"malware"
|
|
]
|
|
}
|
|
]
|
|
} |