From 4cec7a7322486481134078979f3ea5ec14a26720 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 1 Feb 2024 11:01:56 -0800
Subject: [PATCH] [threat-actors] Add Pearl Sleet

---
 clusters/threat-actor.json | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 36f27684..ff7bfb8e 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -14187,6 +14187,21 @@
       },
       "uuid": "a4004712-f74b-4c8c-b1fb-bb7229bc2da1",
       "value": "Cuboid Sandstorm"
+    },
+    {
+      "description": "Pearl Sleet is a nation state activity group based in North Korea that has been active since at least 2012. They primarily target defectors from North Korea, media organizations in carrying out their cyber espionage activities.",
+      "meta": {
+        "country": "KP",
+        "refs": [
+          "https://techcommunity.microsoft.com/t5/microsoft-defender-xdr-blog/monthly-news-december-2023/ba-p/3998431"
+        ],
+        "synonyms": [
+          "DEV-0215",
+          "LAWRENCIUM"
+        ]
+      },
+      "uuid": "ef0d776a-51de-4965-ba1c-69ed256e0e5d",
+      "value": "Pearl Sleet"
     }
   ],
   "version": 298