From 0e23d8b95fc4cd7f79471f8e1465347f9d3a1509 Mon Sep 17 00:00:00 2001
From: Delta-Sierra <deborah.servili@gmail.com>
Date: Thu, 25 Feb 2021 10:21:28 +0100
Subject: [PATCH] add relationships between Maze, Rgnar, Egregor and Sekhmet

---
 clusters/ransomware.json | 48 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 90020a3..f881244 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -13618,6 +13618,15 @@
           "https://www.proofpoint.com/us/threat-insight/post/ta2101-plays-government-imposter-distribute-malware-german-italian-and-us"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "e69f9836-873a-43d3-92a8-97ab783a4171",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "related-to"
+        }
+      ],
       "uuid": "7cea8846-1f3d-331a-3ebf-055d452351b6",
       "value": "Maze"
     },
@@ -13919,6 +13928,22 @@
           "https://securityboulevard.com/2020/10/egregor-sekhmets-cousin/"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "6fb1ea9e-5389-4932-8b22-c691b74b75a8",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "variant-of"
+        },
+        {
+          "dest-uuid": "7cea8846-1f3d-331a-3ebf-055d452351b6",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "successor-of"
+        }
+      ],
       "uuid": "8bd094a7-103f-465f-8640-18dcc53042e5",
       "value": "Egregor"
     },
@@ -14079,6 +14104,13 @@
             "estimative-language:likelihood-probability=\"likely\""
           ],
           "type": "similar"
+        },
+        {
+          "dest-uuid": "7cea8846-1f3d-331a-3ebf-055d452351b6",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "related-to"
         }
       ],
       "uuid": "e69f9836-873a-43d3-92a8-97ab783a4171",
@@ -14100,6 +14132,22 @@
       "ransomnotes-refs": [
         "https://blog.malwarebytes.com/wp-content/uploads/2020/11/Sekhmet_ransom_note.png"
       ],
+      "related": [
+        {
+          "dest-uuid": "8bd094a7-103f-465f-8640-18dcc53042e5",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        },
+        {
+          "dest-uuid": "7cea8846-1f3d-331a-3ebf-055d452351b6",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "successor-of"
+        }
+      ],
       "uuid": "6fb1ea9e-5389-4932-8b22-c691b74b75a8",
       "value": "Sekhmet"
     }