From 57c7d0b9a04bb95714fce32122b791e901a3b91e Mon Sep 17 00:00:00 2001
From: Rony <rony_123@protonmail.ch>
Date: Sat, 6 Mar 2021 19:44:32 +0530
Subject: [PATCH] From Nextron

---
 clusters/threat-actor.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index f5f91fb..49e41df 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -8465,7 +8465,8 @@
           "https://pastebin.com/J4L3r2RS",
           "https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers",
           "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/master/Execution/exchange-iis-worker-dropping-webshell.md",
-          "https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server"
+          "https://msrc-blog.microsoft.com/2021/03/02/multiple-security-updates-released-for-exchange-server",
+          "https://www.nextron-systems.com/2021/03/06/scan-for-hafnium-exploitation-evidence-with-thor-lite"
         ]
       },
       "uuid": "4f05d6c1-3fc1-4567-91cd-dd4637cc38b5",