EternalLiberty

Description

This repository contains all Threat Actor aliases used by different Threat Intelligence companies in their reports.

Objectives

This allows to find the Threats Actors that you want survey or search in getting the name used by different companies or for attribution of samples.

Search and threat actor profiles

<table> <tbody> <tr> <td>Palo Alto</td> <td><ul> <li><a href="https://unit42.paloaltonetworks.com/atoms/">Atoms</a></li> <li><a href="https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens">Playbook</a></li> <ul></td> </tr> <tr> <td>IBM X-Force</td> <td><ul> <li><a href="https://exchange.xforce.ibmcloud.com/search/hive">Threat Actors (Hive)</a></li> <li><a href="https://exchange.xforce.ibmcloud.com/search/ITG">Threat Actors (ITG)</a></li> <ul></td> </tr> <tr> <td>Malpedia</td> <td><ul> <li><a href="https://malpedia.caad.fkie.fraunhofer.de/actors">Threat Actors</a></li> <ul></td> </tr> <tr> <td>Kaspersky</td> <td><ul> <li><a href="https://apt.securelist.com/">Threat Actors</a></li> <ul></td> </tr> <tr> <td>MITRE</td> <td><ul> <li><a href="https://attack.mitre.org/groups/">Threat Actors</a></li> <ul></td> </tr> <tr> <td>Crowdstrike</td> <td><ul> <li><a href="https://adversary.crowdstrike.com/en-US/">Threat Actors profiles</a></li> <li><a href="https://www.crowdstrike.com/adversaries/">Threat Actors profiles + short description</a></li> <ul></td> </tr> <tr> <td>Mandiant</td> <td><ul> <li><a href="https://www.mandiant.com/resources/insights/apt-groups">Well-known Threat Actors</a></li> <li><a href="https://www.mandiant.fr/search?search=APT">Threat Actors (APT)</a></li> <li><a href="https://www.mandiant.fr/search?search=UNC">Threat Actors (UNC)</a></li> <ul></td> </tr> <tr> <td>Secureworks</td> <td><ul> <li><a href="https://www.secureworks.com/research/threat-profiles">Threat Actors profiles</a></li> <ul></td> </tr> <tr> <td>Dragos</td> <td><ul> <li><a href="https://www.dragos.com/threat-activity-groups/">Threat Actors profiles</a></li> <ul></td> </tr> <tr> <td>Thales</td> <td><ul> <li><a href="https://cyberthreat.thalesgroup.com/attackers">Threat Actors profiles</a></li> <ul></td> </tr> <td>Venafi</td> <td><ul> <li><a href="https://threatmodel.venafi.com/groups/">Threat Actors profiles</a></li> <ul></td> </tr> <tr> <td>APTMAP</td> <td><ul> <li><a href="https://andreacristaldi.github.io/APTmap/">Threat Actors profiles</a></li> <ul></td> </tr> <tr> <td>Thai CERT</td> <td><ul> <li><a href="https://apt.etda.or.th/cgi-bin/listgroups.cgi">Threat Actors profiles</a></li> <ul></td> </tr> <tr> <td>CERT-UA</td> <td><ul> <li><a href="https://cert.gov.ua/search/UAC-">Threat Actors (UAC)</a></li> <ul></td> </tr> <tr> <td>Microsoft</td> <td><ul> <li><a href="https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide">Threat Actors + naming taxonomy</a></li> <ul></td> </tr> </tbody> </table>

Naming scheme

Secureworks

<p> Cybercrime -> Gold X<br/> China -> Bronze X<br/> India -> Zinc X<br/> Iran -> Cobalt X<br/> North Korea -> Nickel X<br/> Pakistan -> Copper X<br/> Palestine -> Aluminum X<br/> Russia -> Iron X<br/> South Korea -> Tungsten X<br/> United States -> Platinum X<br/> Vietnam -> Tin X<br/> Emerging Threats -> MoonX ? (MOONSCAPE - TA445 - UAC-0051 - UNC1151) </p>

PWC

<p> North Korea-based (Black)<br/> Russia-based (Blue)<br/> China-based (Red)<br/> Iran-based (Yellow)<br/> India-based (Orange)<br/> Five Eyes-based (Magenta)<br/> Nigeria-based (Bronze)<br/> Location agnostic or based out of multiple countries (Grey)<br/> Cybercrime group (White) </p>

Microsoft

Credits: Microsoft