Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

data/ioc/spyware/amnesty/2024-05-02_wintego_helios/README.md

@@ -0,0 +1,11 @@
+# Wintego Helios Indicators of Compromise
+
+This repository contains network indicators of compromise (IoCs) related to the Helios spyware developed by cyber-surveillance company Wintego. The Helios spyware is designed to target and compromise Android devices. It is unclear if they spyware is also capable of targeting iPhones. Not the Wintego Helios spyware is unrelated to the *Predator spyware* from Intellexa which has also at times been marketed as *Helios*.
+
+These indicators were identified through internet scanning and other research efforts by the Amnesty International [Security Lab](https://securitylab.amnesty.org/). More information about Wintego and their spywareproducts can be found in the [A Web of Surveillance](https://securitylab.amnesty.org/latest/2024/05/a-web-of-surveillance/) report which is wider investigation into the sales of [spyware and surveillance products to Indonesia](https://securitylab.amnesty.org/latest/2024/05/global-a-web-of-surveillance-unravelling-a-murky-network-of-spyware-exports-to-indonesia/).
+
+The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android phones and iPhones.
+
+It includes the following files:
+
+* `domains.txt`: list of Wintego Helios spyware domains

data/ioc/spyware/amnesty/2024-05-02_wintego_helios/domains.txt

@@ -0,0 +1,175 @@
+africatech.eu
+afrinews.eu
+alertanalysis.org
+all-life-fitness.org
+androidcheckupdate.com
+androidsensorfirmware.net
+applibraryupdate.network
+arninja.eu
+astroplanet.org
+ateliernow.org
+autotechhelp.net
+backpackerreviews.org
+basketballreviews.org
+bbc.bio
+bbc.tf
+beaconzero.net
+bestgeometry.org
+bestgreenblog.org
+bestsflix.net
+biceptech.org
+bincoupon.com
+bitsinflow.net
+biznetforum.eu
+blastermaster.eu
+boxmaster.org
+boxpearl.eu
+businesspractice.org
+cafelatenow.com
+carepile.net
+caretechno.net
+caronspot.co
+cartechnews.net
+celltechnollogy.com
+cloudysystems.org
+cnn.gallery
+coffeedirectory.org
+computer-repair.org
+coolbrandlabs.com
+coralspire.net
+craftsplex.net
+daily-tech.eu
+dakaractu.news
+daysomega.com
+dealsenterprise.com
+decofusion.eu
+deepearnings.net
+designercellular.com
+dialrooms.eu
+dinnerfit.org
+doctorstar.org
+draftshape.net
+drinksnow.org
+driverhacks.net
+echoswift.net
+ericshop.org
+expandingtech.net
+expressotelecom.eu
+falconstudio.eu
+fansclear.net
+financeanalyzer.net
+fitnessstar.org
+flexibilycompany.org
+flipcollective.eu
+flyrick.net
+foodystudio.org
+gaincharts.net
+gainthepain.com
+galaxy-toolkit.net
+galaxy-update-check.com
+galaxyupdate.network
+galaxyupdatecheck.com
+gamingtoday.org
+getappnion.org
+getinstitution.org
+gettechnology.org
+globalbikeshop.org
+gotechtube.com
+hikewithmike.eu
+hiphopreviews.org
+hirecheapcar.com
+history-guidance.net
+hugetech.org
+intech.so
+internationalre.org
+jeuneafrique.eu
+jeuneafrique.news
+jotnanews.co
+jotnanews.fr
+jotnanews.live
+laneandco.org
+laptoptech.org
+lidarfirmwareupdate.network
+localsystems.org
+lovekitchen.org
+loyalpro.org
+loyarbox.org
+mambaweb.org
+maplebook.org
+medatcost.co
+michealblog.org
+misoshiru.eu
+mylaylastore.org
+netprotector.org
+nicetreasures.com
+numbersnews.org
+oneinfluence.org
+onlineshoppingnetwork.org
+paperscissors.net
+penlife.org
+piratetv.org
+playerselection.eu
+powerway.org
+proteinreviews.org
+pythonsystems.org
+quickfindnow.net
+realmac.org
+recipeadvice.eu
+reordertree.net
+restroad.eu
+restroad.net
+risetech.one
+riskdrive.eu
+runningmart.org
+securefilter.net
+selfblank.net
+selfhelptech.org
+senedroid.net
+senego.fr
+senego.info
+seneweb.eu
+seneweb.news
+sensomatics.net
+serverdetails.click
+setupvalue.net
+singoffice.net
+sodahub.org
+solararcade.eu
+solargeotech.net
+spacevocal.net
+sporthome.org
+startupfit.org
+storm-tech.org
+swiftecho.eu
+swimaster.org
+swimmingcompany.org
+syndicationcdn.com
+taminessentials.net
+techarmys.com
+techarmys.net
+techdeliver.cc
+technarrow.net
+ten-group.eu
+theholder.org
+thesoundyou.org
+tiktok.do
+tilesget.net
+tipvortex.net
+topmark24.org
+travelow.org
+tribunnews.org
+triptrick.net
+trvelingguide.org
+ultrajewelery.net
+unlockcredit.net
+ups.so
+urbanthree.eu
+vision-tech.org
+waterfit.org
+wateringreviews.org
+webjars.net
+webtechuse.net
+whiskytango.net
+witquote.com
+yachtatdock.com
+yogurthome.org

data/ioc/spyware/amnesty/2024-05-02_wintego_helios/generate_stix.py

@@ -0,0 +1,24 @@
+import sys
+import os
+from stix2.v21 import (Indicator, Malware, Relationship, Bundle, DomainName)
+
+
+if __name__ == "__main__":
+    if os.path.isfile("wintego_helios.stix2"):
+        os.remove("wintego_helios.stix2")
+
+    with open("domains.txt") as f:
+        domains = list(set([a.strip() for a in f.read().split()]))
+
+    res = []
+    malware = Malware(name="Wintego Helios", is_family=False, description="IOCs related to the Wintego Helios spyware")
+    res.append(malware)
+    for d in domains:
+        i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
+        res.append(i)
+        res.append(Relationship(i, 'indicates', malware))
+
+    bundle = Bundle(objects=res)
+    with open("wintego_helios.stix2", "w+") as f:
+        f.write(bundle.serialize(indent=4))
+    print("wintego_helios.stix2 file created")