From 81c2e4d7fe5f44301197839a532f2cdcc214c2a7 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Thu, 14 Dec 2023 15:00:22 +0100
Subject: [PATCH] [threat-actors] Add Hagga aliases

---
 clusters/threat-actor.json | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2e9178d..f76a009 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -11978,7 +11978,13 @@
       "meta": {
         "refs": [
           "https://www.team-cymru.com/post/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor",
-          "https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1"
+          "https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1",
+          "https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/",
+          "https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/"
+        ],
+        "synonyms": [
+          "Aggah",
+          "TH-157"
         ]
       },
       "related": [