malware-indicators - Citizen Lab Malware Reports

项目说明

malware-indicators
==================

This repository includes all malware indicators that were found during the course of Citizen Lab in. Each directory corresponds to a single Citizen Lab report as seen below.

Reports

| Directory | Link | Published |
|-------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------|
| 202006_DarkBasin | Dark Basin: Unco a Massi Operation | June 9, 2020 |
| 201909_MissingLink | MISSING LINK: Tibetan Groups Targeted with Mobile Exploits | Sept 24, 2019 |
| 201905_EndlessMayfly | Burned After Reading: Endless Mayfly’s Ephemeral Disinformation Campaign | May 14, 2019 |
| 201810_TheKingdomCameToCanada | The Kingdom Came to Canada: How Saudi-Linked Digital Espionage Reached Canadian Soil | Oct 1, 2018 |
| 201808_FamiliarFeeling | Familiar Feeling: A Malware Campaign Targeting the Tibetan Diaspora Resurfaces | Aug 8, 2018 |
| 201803_BadTraffic | Bad Traffic: Sandvine’s PacketLogic Devices Used to Deploy Go Spyware in Turkey and Redirect Egyptian Users to Affiliate Ads? | Mar 8, 2018 |
| 201801_SpyingOnABudget | Spying on a Budget: Inside a Phishing Operation with Targets in the Tibetan Community | Jan 30, 2018 |
| 201712_Cyberbit | Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware | Dec 6, 2017 |
| 201707_InsiderInfo | Insider Information: An intrusion campaign targeting Chinese language news sites | Jul 5, 2017 |
| 201706_RecklessRedux | Reckless Redux: Senior Mexican Legislators and Politicians Targeted with NSO Spyware | Jun 29, 2017 |
| 201706_RecklessExploit | Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware | Jun 19, 2017 |
| 201705_TaintedLeaks | Tainted Leaks: Disinformation and Phishing With a Russian Nexus | May 25, 2017 |
| 201702_NilePhish | Nile Phish: Large-Scale Phishing Campaign Targeting Egyptian Ci | Feb 2, 2017 |
| 201611_KeyBoy | It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community | Nov 11, 2016 |
| 201608_NSO_Group | "The Million Dollar Dissident: NSO Group’s iPhone Zero-Days used against a UAE Human Rights Defender" | Aug 24, 2016 |
| 201608_Group5 | "Group5: Syria and the Iranian Connection" | Aug 2, 2016 |
| 201605_Stealth_Falcon | "Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents" | May 29, 2016 |
| 201604_UP007_SLServer | Between Hong Kong and Burma: Tracking UP007 and SLSer Campaigns | Apr 18, 2016 |
| 201603_Shifting_Tactics | Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans | Mar 10, 2016 |
| 201512_PackRAT | "Packrat: Se of a South American Threat Actor" | Dec 8, 2015 |
| 201510_NGO_Burma | Targeted Malware Attacks against NGO Linked to Attacks on Burmese Go Websites | Oct 16, 2015 |
| 201411_Communities | Communities @ Risk: Targeted Digital Threats Against Ci. | Nov 11, 2014 |

Yara signatures can be found here

Formats

The indicators are provided in the following formats.

* CS text comma seperated value with the following columns:
* uuid - A unique identifier for the indicator.
* e - a number that corresponds to the event.
* category - type of broad category for indicator (ex: network activity, payload)
* type - type of indicator (ex: ip-dst, domain, url)
* comment - text comment or annotation
* to_ids - whether this indicator is applicable to be included in an IDS or not
* date - the data when the indicator was added.
* MISP JSON - Structured format used by the Malware Information Sharing Platform
* OpenIOC - Format for OpenIOC an open framework for sharing threat intelligence.
* STIX XML - Format used by the STIX project

License

All data is provided under Creati
Attribution-NonCommercial-ShareAlike 4.0 International and a in full
here and summarized
here

项目信息

开发语言：YARA

Star 数：285

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Citizen Lab Malware Reports展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。