From abca7a02d04eb547383515c1a872d1ce24a45c6d Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 23 Jan 2017 16:20:09 +0100
Subject: [PATCH] Greenbug added

---
 clusters/threat-actor.json | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 0caf168c..82f390bc 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1358,6 +1358,13 @@
         "country": "US",
         "refs": ["https://en.wikipedia.org/wiki/Equation_Group"]
       }
+    },
+    {
+      "value": "Greenbug",
+      "description": "Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, government, investment, and education sectors.",
+      "meta": {
+        "refs": ["https://www.symantec.com/connect/blogs/greenbug-cyberespionage-group-targeting-middle-east-possible-links-shamoon"]
+      }
     }
   ],
   "name": "Threat actor",
@@ -1372,5 +1379,5 @@
   ],
   "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.",
   "uuid": "7cdff317-a673-4474-84ec-4f1754947823",
-  "version": 12
+  "version": 13
 }