[threat-actors] Add Lancefly

clusters/threat-actor.json

@@ -12227,6 +12227,16 @@
       },
       "uuid": "8e93e09a-734d-4b16-933f-9feb58f6ce7d",
       "value": "GoldenJackal"
+    },
+    {
+      "description": "Lancefly targets government, aviation, and telecom organizations in South and Southeast Asia. They use a custom backdoor named Merdoor, developed since 2018, and employ various tactics to gain access, including phishing emails, SSH credential brute-forcing, and exploiting server vulnerabilities. Additionally, Lancefly has been observed using a newer version of the ZXShell rootkit and tools like PlugX and ShadowPad RAT, which are typically associated with Chinese-speaking APT groups.",
+      "meta": {
+        "refs": [
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor"
+        ]
+      },
+      "uuid": "2ceeab57-85e3-468b-a1b8-c035c496dcdc",
+      "value": "Lancefly"
     }
   ],
   "version": 288