Merge pull request #508 from Delta-Sierra/master

add Operation Wocao

clusters/threat-actor.json

@@ -7870,6 +7870,16 @@
       "uuid": "c4ce1174-9462-47e9-8038-794f40a184b3",
       "value": "SideWinder"
     },
+    {
+      "description": "Operation Wocao (我操, “Wǒ cāo”, used as “shit” or “damn”) is the name that Fox-IT uses to describe the hacking activities of a Chinese based hacking group.\nThis report details the profile of a publicly underreported threat actor that Fox-IT has dealt with over the past two years. Fox-IT assesses with high confidence that the actor is a Chinese group and that they are likely working to support the interests of the Chinese government and are tasked with obtaining information for espionage purposes. With medium confidence, Fox-IT assesses that the tools, techniques and procedures are those of the actor referred to as APT20 by industry partners. We have identified victims of this actor in more than 10 countries, in government entities, managed service providers and across a wide variety of industries, including Energy, Health Care and High-Tech.",
+      "meta": {
+        "refs": [
+          "https://www.fox-it.com/nl/actueel/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
+        ]
+      },
+      "uuid": "c432d032-ce2b-4eb8-ba87-312b2a43fb7a",
+      "value": "Operation Wocao"
+    },
     {
       "description": "Based on the evidence we have presented Symantec attributed the activity involving theDripion malware to the Budminer advanced threat group. While we have not seen newcampaigns using Taidoor malware since 2014, we believe the Budminer group has changedtactics to avoid detection after being outed publicly in security white papers and blogs over thepast few years.",
       "meta": {
@@ -7918,5 +7928,5 @@
       "value": "DePriMon"
     }
   ],
-  "version": 152
+  "version": 153
 }