Comfoo

Community Synonyms

• Tabcteng
• DPD or backdoor-DPD (McAfee)
• Wakbot.B (Microsoft)
•  

Malware References

• http://www.secureworks.com/cyber-threat-intelligence/threats/secrets-of-the-comfoo-masters/
• http://global.ahnlab.com/global/upload/download/asecreport/ASEC_Report_Vol.32_Eng.pdf 
• http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_luckycat_redux.pdf
• [related] http://pwc.blogs.com/cyber_security_updates/2014/10/orcarat-a-whale-of-a-tale.html  
• http://home.mcafee.com/virusinfo/virusprofile.aspx?key=144578#none

Nancrat

Community Synonyms

•  Trojan.Nancrat

Malware References

•  https://www.symantec.com/security_response/writeup.jsp?docid=2014-050908-1738-99&tabid=2
•  http://www.symantec.com/connect/blogs/indian-us-uk-finance-department-employees-targeted-remote-access-trojans

Breut

Community Synonym

• Trojan.Breut (Symantec)
• Breut Trojan

Malware Reference

• http://www.symantec.com/connect/blogs/indian-us-uk-finance-department-employees-targeted-remote-access-trojans
• http://www.symantec.com/security_response/writeup.jsp?docid=2012-021012-3004-99&tabid=2

TheMoon

Community Synonyms

•  Linksys Worm

Malware References

•  https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633
• https://www.damballa.com/threat-actors-use-sketchy-dating-website-to-launch-new-home-router-attacks/
• http://www.linksys.com/us/support-article?articleNum=136147
• http://heavy.com/tech/2014/02/linksys-the-moon-router-malware/

IExplore RAT

Community Synonyms

• Sharky RAT (Seth Hardy)
• Briba (Symantec)
• c0d0so0 (iSight)
• file hash: 3D099498CEC9760616437C5265349B83
• Amisharp 

Malware References

• https://citizenlab.org/wp-content/uploads/2012/09/IEXPL0RE_RAT.pdf
• https://citizenlab.org/2011/10/citizen-lab-senior-security-analyst-seth-hardy-presents-at-sector-conference/
• http://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-2843-99&tabid=2
• https://www.alienvault.com/open-threat-exchange/blog/cve-2012-1535-adobe-flash-being-exploited-in-the-wild

Security Breach Notification Laws

I always end up re-inventing the wheel when I need to find this information.  This stands as a location to find the laws per (US) state and what states actually have an active reporting agency.

General Sites about Data Breach or Loss

• http://www.datalossdb.org/
• https://www.privacyrights.org
• http://www.dataprivacymonitor.com/category/breach-notification/

Overview of Laws per State

• http://www.ncsl.org/research/telecommunications-and-information-technology/security-breach-notification-laws.aspx
• http://www.bakerlaw.com/files/Uploads/Documents/Data%20Breach%20documents/Data_Breach_Charts.pdf
• [State & Federal Comparison Chart]  http://www.steptoe.com/assets/htmldocuments/SteptoeDataBreachNotificationChart.pdf

Agency links per State

1. Alabama - No centralized reporting or online presence. 
2. Alaska - No centralized reporting or online presence.
3. Arizona  - No centralized reporting or online presence. 
4. Arkansas - No centralized reporting or online presence. 
5. California - Centralized reporting and searchable database:  https://oag.ca.gov/ecrime/databreach/reporting
6. Colorado - No centralized reporting or online presence. 
7. Connecticut - No centralized reporting or online presence.  
8. Delaware - No centralized reporting or online presence. 
9. Florida - No centralized reporting or online presence.   http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0500-0599/0501/Sections/0501.171.html
10. Georgia - No centralized reporting or online presence. 
11. Hawaii - No centralized agency but reporting generally flows through Dept. of Commerce.  Requires some digging to find. http://cca.hawaii.gov/
12. Idaho - No centralized reporting or online presence. 
13. Illinois - No centralized reporting or online presence. 
14. Indiana - No centralized reporting or online presence. 
15. Iowa - No centralized reporting or online presence. www.ivrs.iowa.gov/
16. Kansas - No centralized reporting or online presence. 
17. Kentucky - No centralized reporting or online presence. 
18. Louisiana - No centralized reporting or online presence. 
19. Maine - Maine is even worse and each entity has to be approached and contacted individually.  http://www.maine.gov/foaa/contactlist/index.htm
20. Maryland - centralized reporting.  http://www.oag.state.md.us/idtheft/breachNotices2015.htm
21. Massachusetts - Requires a public records request.  http://www.sec.state.ma.us/pre/prereq/reqidx.htm
22. Michigan - No centralized reporting or online presence. 
23. Minnesota - No centralized reporting or online presence. 
24. Mississippi - No centralized reporting or online presence. 
25. Missouri - No centralized reporting or online presence.  https://www.ago.mo.gov/divisions/consumer/identity-theft-data-security/data-breaches
26. Montana - No centralized reporting or online presence. 
27. Nebraska - No centralized reporting or online presence. 
28. Nevada - No centralized reporting or online presence. 
29. New Hampshire - No centralized reporting or online presence. 
30. New Jersey - No centralized reporting or online presence.  http://www.state.nj.us/lps/
31. New Mexico - No centralized reporting or online presence. 
32. New York - No centralized reporting or online presence.  http://www.consumer.state.ny.us/
33. North Carolina - Centralized reporting but no online presence or searchable database.  http://www.ncdoj.com/Protect-Yourself/2-4-3-Protect-Your-Identity/Protect-Your-Business/Security-Breach-Information.aspx
34. North Dakota - No centralized reporting or online presence. 
35. Ohio - No centralized reporting or online presence. 
36. Oklahoma - No centralized reporting or online presence. 
37. Oregon - Centralized reporting and searchable database https://justice.oregon.gov/consumer/DataBreach/
38. Pennsylvania - No centralized reporting or online presence. 
39. Rhode Island - No centralized reporting or online presence. 
40. South Carolina - Notifications required but no centralized reporting or online presence.  http://www.consumer.sc.gov/Pages/default.aspx
41. South Dakota - No centralized reporting or online presence. 
42. Tennessee  - No centralized reporting or online presence. 
43. Texas - No centralized reporting or online presence. 
44. Utah - No centralized reporting or online presence. 
45. Vermont - Reporting doesn't seem centralized but a list of breach notices are accessible online.  http://ago.vermont.gov/focus/consumer-info/privacy-and-data-security1/data-security-breaches.php
46. Virginia - Centralized reporting but no online presence or searchable database.  http://www.ag.virginia.gov/
47. Washington - No centralized reporting or online presence. 
48. West Virginia - No centralized reporting or online presence. 
49. Wisconsin - No centralized reporting or online presence. 
50. Wyoming - No centralized reporting or online presence. 

KillDisk

Community Synonyms

• Mal/Defkill-A (Sophos)

Malware References

• http://www.symantec.com/connect/blogs/destructive-disakil-malware-linked-ukraine-power-outages-also-used-against-media-organizations
• http://www.symantec.com/connect/blogs/destructive-disakil-malware-linked-ukraine-power-outages-also-used-against-media-organizations
• https://ics.sans.org/blog/2016/01/01/potential-sample-of-malware-from-the-ukrainian-cyber-attack-uncovered
• https://nakedsecurity.sophos.com/2016/01/06/ukraine-power-outages-blamed-on-hackers-and-malware/

sshbeardoor

Community Synonyms

• DrpBear-A (Sophos)

Malware References

• http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/
• [malware based off of ] https://github.com/mkj/dropbear
• https://nakedsecurity.sophos.com/2016/01/06/ukraine-power-outages-blamed-on-hackers-and-malware/

Black Energy

Community Synonyms

• Sandworm (via SandWorm usage of BE2; iSight Partners)
• Kernelbot (malware.dontneedcoffe)
• Lancafdo (Symantec)
• Blacken (Sophos)

Malware References

• http://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/
• http://www.welivesecurity.com/2014/09/22/back-in-blackenergy-2014/
• http://www.welivesecurity.com/2014/10/14/cve-2014-4114-details-august-blackenergy-powerpoint-campaigns/
• https://www.virusbtn.com/conference/vb2014/abstracts/LM3-LipovskyCherepanov.xml
• http://atlas-public.ec2.arbor.net/docs/BlackEnergy+DDoS+Bot+Analysis.pdf
• https://securelist.com/blog/research/67353/be2-custom-plugins-router-abuse-and-target-profiles/
• https://securelist.com/analysis/publications/36309/black-ddos/
• https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf
• http://malware.dontneedcoffee.com/2014/06/botnetkernel.html
• http://blog.trendmicro.com/sandworm-and-scada/
• http://www.isightpartners.com/2014/10/cve-2014-4114/
• http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/
• https://www.first.org/resources/papers/conf2015/first_2015_-_wilhoit-_kyle_-_malware_in_your_pipes_20150630.pdf
• http://www.cyactive.com/total-blackout-sandworm-team-reuse-blackenergy/
• http://www.critical-intelligence.com/resources/papers/CI-Sandworm-BE2.pdf
• http://www.secureworks.com/assets/pdf-store/articles/Understanding_and_Combating_DDoS_Attacks.pdf
• http://www.symantec.com/connect/blogs/destructive-disakil-malware-linked-ukraine-power-outages-also-used-against-media-organizations
• https://nakedsecurity.sophos.com/2016/01/06/ukraine-power-outages-blamed-on-hackers-and-malware/

Lstudio

Community Synonyms

• Wumins
• Elise
• Evora
• Emissary
• stscout
• Page

Malware References

• http://www.slideshare.net/burguzbozo/hunting-the-shadows-in-depth-analysis-of-escalated-apt-attacks or https://media.blackhat.com/us-13/US-13-Yarochkin-In-Depth-Analysis-of-Escalated-APT-Attacks-Slides.pdf
• http://contagioexchange.blogspot.com/2013/09/page-elise-lstudio-wumins-strings-apt.html
• http://researchcenter.paloaltonetworks.com/2015/12/attack-on-french-diplomat-linked-to-operation-lotus-blossom/
• http://researchcenter.paloaltonetworks.com/2015/06/operation-lotus-blossom/

Elirks

Community Synonyms

Malware References

• http://www.slideshare.net/burguzbozo/hunting-the-shadows-in-depth-analysis-of-escalated-apt-attacks
• http://www.secureworks.com/cyber-threat-intelligence/threats/chasing_apt/

Lecna

Community Synonyms

• Backspace

Malware References

• https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf
• https://www2.fireeye.com/WEB-2015RPTAPT30.html
• https://www.fireeye.com/blog/threat-research/2015/04/apt_30_and_the_mecha.html
• http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=BACKDOOR:WIN32/LECNA.G#tab-link-3
• https://www.symantec.com/security_response/writeup.jsp?docid=2006-053112-3821-99&tabid=2
• https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=246

PlugX

Community Synonyms

• Derusbi
• Destory RAT
• Kaba
• Sogu
• Thoper
• TVT
• Gulpix

Malware References

• http://blogs.cisco.com/security/talos/threat-spotlight-group-72
• https://www.circl.lu/pub/tr-24/
• http://labs.lastline.com/an-analysis-of-plugx
• https://www.fireeye.com/blog/threat-research/2014/07/pacific-ring-of-fire-plugx-kaba.html
• https://www.fireeye.com/blog/threat-research/2013/11/exploit-proliferation-additional-threat-groups-acquire-cve-2013-3906.html
• http://blog.cassidiancybersecurity.com/post/2014/01/plugx-some-uncovered-points.html
• https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html
• http://researchcenter.paloaltonetworks.com/2015/05/plugx-uses-legitimate-samsung-application-for-dll-side-loading/
• http://www.csee.umbc.edu/courses/undergraduate/CMSC491malware/fireeye-malware-supply-chain.pdf
• https://securityledger.com/2013/11/malware-supply-chain-links-eleven-attacks/
• https://www.blackhat.com/docs/asia-14/materials/Haruyama/Asia-14-Haruyama-I-Know-You-Want-Me-Unplugging-PlugX.pdf
• http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf