ZeroT added

clusters/tool.json

@@ -1277,14 +1277,21 @@
     },
     {
        "value": "Flokibot",
-       "description": "",
+       "description": "Floki Bot, described recently by Dr. Peter Stephenson from SC Magazine, is yet another bot based on the leaked Zeus code. However, the author came up with various custom modifications that makes it more interesting.",
        "meta": {
-        "refs": ["https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/"],
+        "refs": ["https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/", "https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/"],
         "synonyms": ["Floki Bot"]
        }
+    },
+    {
+       "value": "ZeroT",
+       "description": "Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus. Since the summer of 2016, this group began using a new downloader known as ZeroT to install the PlugX remote access Trojan (RAT) and added Microsoft Compiled HTML Help (.chm) as one of the initial droppers delivered in spear-phishing emails.",
+       "meta": {
+        "refs": ["https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"]
+       }
     }
   ],
-  "version": 17,
+  "version": 18,
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "author": [