From 3774f0523730214c3a35b681e2ba6a3248317f51 Mon Sep 17 00:00:00 2001
From: Thanat0s <Thanspam@trollprod.org>
Date: Sun, 26 Feb 2017 23:07:42 +0100
Subject: [PATCH] Somes alias fetch from : https://attack.mitre.org/wiki/Groups

---
 clusters/threat-actor.json | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 3197fee2..c7d03b71 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9,7 +9,8 @@
           "Advanced Persistent Threat 1",
           "Byzantine Candor",
           "Group 3",
-          "TG-8223"
+          "TG-8223",
+          "Comment Group"
         ],
         "country": "CN",
         "refs": [
@@ -670,7 +671,9 @@
         "synonyms": [
           "Operation Cleaver",
           "Tarh Andishan",
-          "Alibaba"
+          "Alibaba",
+          "2889",
+          "TG-2889"
         ],
         "refs": [
           "http://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
@@ -1100,6 +1103,10 @@
     },
     {
       "meta": {
+        "synonyms": [
+          "TG-3390",
+          "Emissary Panda"
+        ],
         "refs": [
           "http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/",
           "https://attack.mitre.org"