Update 2021-09-29 SOLORIGATE

Added: - Microsoft: Breaking down NOBELIUM’s latest early-stage toolset - Microsoft: FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor - Microsoft: mstic/Indicators/May21-NOBELIUM/
jipegit · Sep 29, 2021 · 683d00a · 683d00a
1 parent 104bf5c
commit 683d00a
Show file tree

Hide file tree

Showing 5 changed files with 24 additions and 0 deletions.
diff --git a/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.md b/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.md
@@ -177,6 +177,10 @@
 
 - https://www.trustedsec.com/blog/solarwinds-backdoor-sunburst-incident-response-playbook/
 
+### Microsoft IOC
+
+- https://github.com/microsoft/mstic/tree/master/Indicators/May21-NOBELIUM
+
 ## Security Advisory
 
 ### https://www.solarwinds.com/securityadvisory
@@ -389,3 +393,15 @@
 
 ### Goldfinger, Sibot
 
+### EnvyScout, BoomBox, NativeZone
+
+- Microsoft
+
+	- **https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/**
+
+### FoggyWeb
+
+- Microsoft
+
+	- https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
+
diff --git a/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.mindnode b/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.mindnode
diff --git a/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.opml b/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.opml
@@ -91,6 +91,8 @@
 </outline>
 <outline text="Generic Playbook"><outline text="https://www.trustedsec.com/blog/solarwinds-backdoor-sunburst-incident-response-playbook/"></outline>
 </outline>
+<outline text="Microsoft IOC"><outline text="https://github.com/microsoft/mstic/tree/master/Indicators/May21-NOBELIUM"></outline>
+</outline>
 </outline>
 <outline text="Security Advisory"><outline text="https://www.solarwinds.com/securityadvisory"></outline>
 <outline text="https://us-cert.cisa.gov/ncas/alerts/aa21-008a"></outline>
@@ -197,6 +199,12 @@
 </outline>
 </outline>
 <outline text="Goldfinger, Sibot"></outline>
+<outline text="EnvyScout, BoomBox, NativeZone"><outline text="Microsoft"><outline text="https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"></outline>
+</outline>
+</outline>
+<outline text="FoggyWeb"><outline text="Microsoft"><outline text="https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"></outline>
+</outline>
+</outline>
 </outline>
 </outline>
 </body>

diff --git a/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.pdf b/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.pdf
diff --git a/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.png b/SOLORIGATE_SUNBURST/SOLORIGATE_SUNBURST.png