MISP 2.4.153 adds features, security fixes

4 February 2022 low threat technology

MISP released version 2.4.153 with new taxonomies, galaxy updates, module improvements and a security fix for the bundled Markdown-IT library.

This release note covers MISP 2.4.153, a routine update to the open-source threat intelligence platform. The update includes UI, synchronization, and debugging improvements, along with expanded misp-stix library support for STIX import/export. A notable security-relevant change is the update of the Markdown-IT library to version 12.3.2, which includes upstream security fixes, alongside additional CLI security tests.

The release also expands MISP's taxonomy and galaxy content, adding new threat-actor entries such as SideCopy and AQUATIC PANDA, a new surveillance group entry for Cytrox, and a new Unified Kill Chain taxonomy. Various MISP modules were updated, including a new VirusTotal collection export module, an improved CrowdStrike Falcon expansion module, and a Censys module update for its new API. Overall this is a standard maintenance and feature release rather than a report of active threat activity.

Mentioned in this report

Threat actors Aquatic PandaSideCopy

Malware Cytrox Predator

Source reporting: https://www.misp-project.org/2022/02/04/misp.2.4.153.released.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free