From 8a9dd47f8f27bc10759e4917e1c246b0c7a35940 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Wed, 2 Nov 2022 23:48:51 -0700
Subject: [PATCH] [threat-actors] Add Phosphorus in APT35 aliases

---
 clusters/threat-actor.json | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b4923fb4..2633df17 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1644,7 +1644,6 @@
           "Parastoo",
           "iKittens",
           "Group 83",
-          "Newsbeef",
           "NewsBeef",
           "G0058"
         ]
@@ -5588,13 +5587,15 @@
           "https://www.cfr.org/interactive/cyber-operations/magic-hound",
           "https://unit42.paloaltonetworks.com/unit42-magic-hound-campaign-attacks-saudi-targets/",
           "https://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html",
-          "https://www.cfr.org/cyber-operations/apt-35"
+          "https://www.cfr.org/cyber-operations/apt-35",
+          "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/",
+          "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
         ],
         "synonyms": [
-          "APT 35",
           "Newscaster Team",
           "Magic Hound",
-          "G0059"
+          "G0059",
+          "Phosphorus"
         ]
       },
       "related": [