Ukraine-Cyber-Operations - Curated Intelligence is working with analysts from

项目说明

!logo

Ukraine Cyber Operations

Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional free threat intelligence. Sla. Glory to Ukraine. (Blog | Twitter | LinkedIn)

Resources

- ### Timeline of 2022 Threat Reports
- #### January Threat Reports
- #### February Threat Reports
- #### March Threat Reports
- #### April Threat Reports
- #### May Threat Reports
- #### June Threat Reports
- #### July Threat Reports
- #### August Threat Reports
- #### September Threat Reports
- #### October Threat Reports
- #### No Threat Reports
- #### December Threat Reports
- ### Timeline of 2023 Threat Reports
- #### January Threat Reports
- #### February Threat Reports
- #### April Threat Reports
- #### May Threat Reports
- #### June Threat Reports

- #### Support
- #### OSINT Sources
- #### Miscellaneous Resources
- #### Equinix Threat Analysis Center (ETAC) contributions:
- Contextualized Indicators of Compromise (IOCs) by ETAC (Last updated 25 March 2022)
- Contextualized CERT-UA IOCs - see here (Last updated 28 March 2022)
- YARA rule collection by ETAC (Last updated 4 April 2022)
- Graphic of a Timeline of Russia-Ukraine Cyberwar (Last updated 14 March 2022)
- Graphic of a Map of Russia-Ukraine Cyberwar (Last updated 3 March 2022 )
- #### KPMG-Egyde Contributions:
- Added loosely- IOC Threat Hunt Feeds (h/t 0xDISREL) (Last updated 7 April 2022)
- IOCs shared by these feeds are LOW-TO-MEDIUM CONFIDENCE we strongly recommend NOT adding them to a blocklist
- These could potentially be used for THREAT HUNTING and could be added to a WATCHLIST
- IOCs are generated in MISP COMPATIBLE CS
- Additional Threat Hunt Feed for recently registered Ukrainian domain names (h/t DomainTools)
- Additional Threat Hunt Feed for threat groups targeting Ukraine (h/t RecordedFuture)
- Ukrainain organizations offered by Access and Data Brokers on underground forums

Graphics by ETAC

!timeline

!cyberwar

#### Support
| | Offering | URL |
| --- | --- | --- |
| Dragos | Access to Dragos service if from US/UK/ANZ and in need of ICS cybersecurity support | twitter.com/RobertMLee |
| GreyNoise | Any and all Ukrainian emails registered to GreyNoise have been upgraded to includes full, uncapped enterprise access to all GreyNoise products. There is a landing page for GreyNoise data at | twitter.com/Andrew___Morris |
| Recorded Future | Pro free intelligence-dri, perspectives, and mitigation strategies as the situation in Ukraine e| recordedfuture.com |
| Flashpoint | Free Access to Flashpoint’s Latest Threat Intel on Ukraine | go.flashpoint-intel.com |
| ThreatABLE | A Ukraine tag for free threat intelligence feed that's more highly curated to cyber| twitter.com/threatable |
| Orange | IOCs related to Russia-Ukraine 2022 conflict extracted from our Datalake Threat Intelligence platform. | github.com/Orange-Cyberdefense|
| FSecure | F-Secure FREEDOME VPN is now a for free in all of Ukraine | twitter.com/FSecure |
| Multiple | List of offering their services to Ukraine for free, put together by | docs.google.com/spreadsheets |
| Mandiant | Free threat intelligence, webinar and guidance for defensi relevant to the situation in Ukraine. | mandiant.com |
| Starlink | Satellite internet constellation operated by SpaceX pro satellite Internet access co to Ukraine | twitter.com/elonmusk |
| Romania DNSC | Romania’s DNSC – in partnership with Bitdefender – will provide technical consulting, threat intelligence and, free of charge, cybersecurity technology to any business, go institution or private citizen of Ukraine for as long as it is necessary. | Romania's DNSC Press Release|
| BitDefender | Access to Bitdefender technical consulting, threat intelligence and both consumer and enterprise cybersecurity technology | bitdefender.com/ukraine/ |
| NameCheap | Free anonymous hosting and domain name registration to any anti-Putin anti-regime and protest websites for anyone located within Russia and Belarus | twitter.com/Namecheap |
| Avast | Free decryptor for PartyTicket ransomware | decoded.avast.io |
| Recorded Future | Insikt Group’s list of indicators of compromise associated with threat actors and malware related to the Russian cyber actions against Ukraine | recordedfuture.com |
| CybelAngel | CybelAngel offers its services to interested NGOs active in the war at no cost, to minimize the risks of their missions being interrupted by cyber attacks. CybelAngel also offers Ukrainian companies an assessment of their digital exposure in the region at no charge. | cybelangel.com |
| Malware Patrol | Free 6 months DNS Firewall service subscription for Ukraine-based companies and go entities | www.linkedin.com |
| UnderDefense | UnderDefense is pro Managed Detection & Response services and incident repsonse support for Ukrainian critical infrastructure & go consulting in cybersecurity | underdefense.com |

#### OSINT Sources
| Handle | Affiliation |
| --- | --- |
| @Kyi | English-language journalism in Ukraine |
| | Defense reporter with The Kyi |
| | English-language journalism in Ukraine |
| | BBC World News Disinformation journalist |
| @Li | Li Awareness Map (“Li”) independent global news and information site |
| | The Alperovitch Institute for Cybersecurity Studies, Founder & Former CTO of CrowdStrike |
| | OSINT in for Centre for Information Resilience |
| | London-based Internet's Obser |

#### Miscellaneous Resources
| Source | URL | Content |
| --- | --- | --- |
| PowerOutages.com | | Tracking PowerOutages across Ukraine |
| Monash IP Obser | | Tracking IP address outages across Ukraine |
| Project Owl Discord | | Tracking foreign policy, geopolitical events, military and go, using a Discord-based crowdsourced approach, with a current emphasis on Ukraine and Russia |
| russianwarchatter.info | | Known Russian Military Radio Frequencies |
| UT CREEES | | Compiled resources to help understand the Russian in of Ukraine, with links to resources, action items, and academic sources |
|
|
| CERT-UA | | Computer Emergency Response Team (CERT) of Ukraine |
|
| Twitter | | State Service of Special Communications and Information Protection of Ukraine |
|
|
|
|
|
|
|

Note:

Curated Intel does not support, encourage, partake, or condone hacking, attacking or targeting users of any kind. This information is clearly meant to help cybersecurity teams supporting Ukraine still doing their jobs while dealing with the Russian in.

项目信息

开发语言：YARA

Star 数：936

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Curated Intelligence is working with analysts from around the world to provide useful information to organisations in Ukraine looking for additional free threat intelligence. Slava Ukraini. Glory to Ukraine.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。