From 303eb8a0d6e193944981f976e4f41eb8f1b1f140 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Thu, 2 May 2024 04:50:10 -0700 Subject: [PATCH] [threat-actors] Add SaintBear aliases --- clusters/threat-actor.json | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 2cc1f6a6..2d5e637d 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -10497,7 +10497,9 @@ "https://unit42.paloaltonetworks.com/atoms/nascentursa/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer", "https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/", - "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/" + "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/", + "https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope", + "https://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf" ], "synonyms": [ "UNC2589", @@ -10508,7 +10510,8 @@ "FROZENVISTA", "Storm-0587", "DEV-0587", - "Saint Bear" + "Saint Bear", + "Lorec53" ] }, "uuid": "c67d3dfb-ab39-46e1-a971-5efdfe6a5b9f",