Empire status, Nebula, Blaze/Terror

clusters/exploit-kit.json

@@ -10,7 +10,21 @@
        "synonyms": [
           "Stegano EK"
         ],
-		"status": "Unknown - Last Seen 2016-12-07"
+		"status": "Active"
+       }
+    }
+,
+    { "value": "Blaze EK",
+      "description": "Blaze EK is a rebranding of Terror EK built on Hunter EK code",
+      "meta": {
+        "refs": [
+          "https://www.trustwave.com/Resources/SpiderLabs-Blog/Terror-Exploit-Kit--More-like-Error-Exploit-Kit/"
+        ],
+       "synonyms": [
+          "Terror EK"
+        ]
+	   ,
+		"status": "Active"
        }
     }
 ,
@@ -41,20 +55,6 @@
 		"status": "Active"
        }
     }
-,
-    { "value": "Empire",
-      "description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
-      "meta": {
-        "refs": [
-          "http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
-        ],
-       "synonyms": [
-          "RIG-E"
-        ]
-	   ,
-		"status": "Unknown - Last seen: 2016-12-29"
-       }
-    }
 ,
     { "value": "Hunter",
       "description": "Hunter EK is an evolution of 3Ros EK",
@@ -90,12 +90,12 @@
         "refs": [
 	      "http://malware.dontneedcoffee.com/2013/10/Magnitude.html",
           "https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Peek-Into-the-Lion-s-Den-%E2%80%93-The-Magnitude--aka-PopAds--Exploit-Kit/",
-          "http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html"
+          "http://malware.dontneedcoffee.com/2014/02/and-real-name-of-magnitude-is.html",
+		  "https://community.rsa.com/community/products/netwitness/blog/2017/02/09/magnitude-exploit-kit-under-the-hood"
         ],
        "synonyms": [
           "Popads EK",
-          "TopExp",
+          "TopExp"
-	  "Pangimop"
         ],
 		"status": "Active"
        }
@@ -111,6 +111,16 @@
 		"status": "Active"
        }
     }
+,
+    { "value": "Nebula",
+      "description": "Nebula Exploit Kit has been built on Sundown source and features an internal TDS",
+      "meta": {
+        "refs": [
+          "http://malware.dontneedcoffee.com/2017/03/nebula-exploit-kit.html"
+        ],
+		"status": "Active"
+       }
+    }
 ,
     { "value": "Neutrino",
       "description": "Neutrino Exploit Kit has been one of the major exploit kit from its launch in 2013 till september 2016 when it become private (defense name for this variation is Neutrino-v). This EK vanished from  march 2014 till november 2014.",
@@ -122,7 +132,7 @@
        "synonyms": [
           "Job314",
           "Neutrino Rebooted",
-          "Neutrino-v"
+		  "Neutrino-v"
         ]		
 		,
 		"status": "Active"
@@ -196,7 +206,7 @@
        "synonyms": [
           "Beps",
           "Xer",
-          "Beta"
+		  "Beta"
         ],
 		"status": "Active",
 		"colour": "#C03701"
@@ -214,7 +224,7 @@
        "synonyms": [
           "XXX",
           "AEK",
-          "Axpergle"
+		  "Axpergle"
         ],
 		"status": "Retired - Last seen: 2016-06-07"
        }
@@ -285,12 +295,26 @@
         ],
        "synonyms": [
           "NeoSploit",
-          "Fiexp"
+		  "Fiexp"
         ]
 		,
 		"status": "Retired - Last Seen: beginning of 2015-07"
        }
     }
+,
+    { "value": "Empire",
+      "description": "The Empire Pack is a variation of RIG operated by a load seller. It's being fed by many traffic actors",
+      "meta": {
+        "refs": [
+          "http://malware.dontneedcoffee.com/2016/10/rig-evolves-neutrino-waves-goodbye.html"
+        ],
+       "synonyms": [
+          "RIG-E"
+        ]
+	   ,
+		"status": "Retired - Last seen: 2016-12-29"
+       }
+    }
 ,
     { "value": "FlashPack",
       "description": "FlashPack EK got multiple fork. The most common variant seen was the standalone Flash version",
@@ -454,7 +478,7 @@
         "refs": [
           "https://www.trustwave.com/Resources/SpiderLabs-Blog/A-Wild-Exploit-Kit-Appears----Meet-RedKit/",
           "http://malware.dontneedcoffee.com/2012/05/inside-redkit.html",
-          "https://nakedsecurity.sophos.com/2013/05/09/redkit-exploit-kit-part-2/"
+		  "https://nakedsecurity.sophos.com/2013/05/09/redkit-exploit-kit-part-2/"
         ],
 		"status": "Retired"
        }
@@ -478,7 +502,7 @@
         ],
        "synonyms": [
           "SWO",
-          "Anogre"
+		  "Anogre"
         ],
 		"status": "Retired - Last seen: 2015-04-05"
        }
@@ -489,7 +513,7 @@
       "meta": {
         "refs": [
           "http://malware.dontneedcoffee.com/2012/12/crossing-styx-styx-sploit-pack-20-cve.html",
-          "https://krebsonsecurity.com/2013/07/styx-exploit-pack-domo-arigato-pc-roboto/",
+		  "https://krebsonsecurity.com/2013/07/styx-exploit-pack-domo-arigato-pc-roboto/",
           "http://malware.dontneedcoffee.com/2013/05/inside-styx-2013-05.html"
         ],
 		"status":"Retired - Last seen: 2014-06"
@@ -501,13 +525,13 @@
       "meta": {
         "refs": [
           "https://twitter.com/kafeine",
-          "https://twitter.com/node5",
+		  "https://twitter.com/node5",
           "https://twitter.com/kahusecurity"
         ]
        }
     }
 ],
-  "version": 3,
+  "version": 4,
   "uuid": "454f4e78-bd7c-11e6-a4a6-cec0c932ce01",
   "description": "Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits.It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years",
   "authors": [