From 355a23018288b10894c770a8ff84e6e78261ca63 Mon Sep 17 00:00:00 2001
From: Daniel Plohmann <plohmann@cs.uni-bonn.de>
Date: Tue, 1 Aug 2017 13:29:57 +0200
Subject: [PATCH] added FIN7 as alias for anunak

---
 clusters/threat-actor.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4a8ca809..8392d19c 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -863,11 +863,13 @@
       "meta": {
         "synonyms": [
           "Carbanak",
-          "Carbon Spider"
+          "Carbon Spider",
+          "FIN7"
         ],
         "country": "RU",
         "refs": [
-          "https://en.wikipedia.org/wiki/Carbanak"
+          "https://en.wikipedia.org/wiki/Carbanak",
+          "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor"
         ],
         "motive": "Cybercrime"
       },