// APT Group profiles with comprehensive threat actor information
// Synced from frontend/src/components/PublicOperationDetail.jsx

const APT_PROFILES = {
    'APT29': {
        aliases: ['Cozy Bear', 'The Dukes', 'NOBELIUM', 'Midnight Blizzard'],
        origin: 'Russia (SVR)',
        targets: 'Government, Defense, Healthcare, Think Tanks',
        ttps: ['Supply Chain Attacks', 'Spearphishing', 'OAuth Abuse', 'Cloud Exploitation'],
        notableAttacks: ['SolarWinds (2020)', 'Democratic National Committee (2016)', 'COVID-19 Vaccine Research (2020)'],
        description: 'APT29 is attributed to Russia\'s Foreign Intelligence Service (SVR). Known for sophisticated supply chain attacks and long-term persistent access campaigns targeting Western governments and critical infrastructure.'
    },
    'APT28': {
        aliases: ['Fancy Bear', 'Sofacy', 'STRONTIUM', 'Forest Blizzard'],
        origin: 'Russia (GRU Unit 26165)',
        targets: 'Government, Military, Media, Political Organizations',
        ttps: ['Credential Harvesting', 'Zero-Day Exploits', 'Watering Hole Attacks', 'Disinformation'],
        notableAttacks: ['US Election Interference (2016)', 'WADA Hack (2016)', 'German Bundestag (2015)'],
        description: 'APT28 is linked to Russia\'s GRU military intelligence. Known for aggressive cyber operations including election interference, disinformation campaigns, and attacks on democratic institutions worldwide.'
    },
    'APT32': {
        aliases: ['OceanLotus', 'APT-C-00', 'SeaLotus', 'Canvas Cyclone'],
        origin: 'Vietnam',
        targets: 'Foreign Governments, Dissidents, Journalists, Automotive',
        ttps: ['Spearphishing', 'Watering Holes', 'Custom Malware', 'Social Engineering'],
        notableAttacks: ['Automotive Industry Espionage', 'Southeast Asian Government Targeting', 'COVID-19 Research Theft'],
        description: 'APT32 conducts cyber espionage primarily targeting Southeast Asian countries, dissidents, journalists, and multinational corporations with interests in Vietnam.'
    },
    'Lazarus Group': {
        aliases: ['HIDDEN COBRA', 'Guardians of Peace', 'APT38', 'Diamond Sleet'],
        origin: 'North Korea (RGB)',
        targets: 'Financial Institutions, Cryptocurrency, Defense, Entertainment',
        ttps: ['Destructive Malware', 'Financial Theft', 'Ransomware', 'Supply Chain'],
        notableAttacks: ['Sony Pictures (2014)', 'WannaCry (2017)', 'Bangladesh Bank Heist (2016)', 'Ronin Bridge ($625M)'],
        description: 'Lazarus Group is North Korea\'s primary cyber operations unit. Known for high-profile attacks combining espionage with cyber-enabled financial theft to fund the regime.'
    },
    'APT10': {
        aliases: ['Stone Panda', 'MenuPass', 'Cloud Hopper', 'Red Apollo'],
        origin: 'China (MSS)',
        targets: 'MSPs, Healthcare, Aviation, Technology, Government',
        ttps: ['Cloud Hopper Campaign', 'MSP Targeting', 'Credential Theft', 'Long-term Persistence'],
        notableAttacks: ['Cloud Hopper (2014-2018)', 'Bureau of Meteorology Australia', 'Healthcare Record Theft'],
        description: 'APT10 is linked to China\'s Ministry of State Security. Famous for the "Cloud Hopper" campaign targeting managed service providers to access their clients\' networks.'
    },
    'APT34': {
        aliases: ['OilRig', 'Helix Kitten', 'IRN2', 'Hazel Sandstorm'],
        origin: 'Iran (MOIS)',
        targets: 'Middle East Governments, Financial, Energy, Telecommunications',
        ttps: ['DNS Tunneling', 'Web Shells', 'Credential Harvesting', 'Custom Backdoors'],
        notableAttacks: ['Lebanese Government', 'Multiple Oil Companies', 'Telecommunication Providers'],
        description: 'APT34 is an Iranian threat group conducting cyber espionage focused primarily on Middle Eastern organizations, particularly in the energy and financial sectors.'
    },
    'Sandworm': {
        aliases: ['Voodoo Bear', 'IRIDIUM', 'Seashell Blizzard', 'Unit 74455'],
        origin: 'Russia (GRU Unit 74455)',
        targets: 'Critical Infrastructure, Energy, Government, Olympics',
        ttps: ['Destructive Attacks', 'ICS/SCADA Targeting', 'Wiper Malware', 'Supply Chain'],
        notableAttacks: ['Ukraine Power Grid (2015-2016)', 'NotPetya (2017)', 'Olympic Destroyer (2018)'],
        description: 'Sandworm is Russia\'s most destructive cyber unit. Responsible for the first successful cyber attacks on power grids and the NotPetya attack causing $10B in damages globally.'
    },
    'APT41': {
        aliases: ['Winnti', 'Double Dragon', 'Brass Typhoon', 'Barium'],
        origin: 'China',
        targets: 'Gaming, Healthcare, Technology, Telecom, Government',
        ttps: ['Supply Chain Attacks', 'Ransomware', 'Cryptocurrency Mining', 'Espionage'],
        notableAttacks: ['CCleaner Supply Chain', 'ASUS Supply Chain', 'Gaming Industry Attacks'],
        description: 'APT41 is unique in conducting both state-sponsored espionage and financially-motivated attacks. Known for sophisticated supply chain compromises and targeting the gaming industry.'
    }
};

/**
 * Helper to find matching APT profile
 * @param {string} aptGroup - The name of the APT group (fuzzy match)
 * @returns {Object|null} The profile object or null
 */
const getAptProfile = (aptGroup) => {
    if (!aptGroup) return null;
    for (const [key, profile] of Object.entries(APT_PROFILES)) {
        if (aptGroup.toLowerCase().includes(key.toLowerCase()) || 
            profile.aliases.some(alias => aptGroup.toLowerCase().includes(alias.toLowerCase()))) {
            return { name: key, ...profile };
        }
    }
    return null;
};

module.exports = {
    APT_PROFILES,
    getAptProfile
};
