Merge branch 'Delta-Sierra-master'

clusters/backdoor.json

@@ -80,7 +80,17 @@
       ],
       "uuid": "a4757e11-0837-42c0-958a-7490cff58687",
       "value": "SLUB"
+    },
+    {
+      "description": "Since it first emerged in 2015, Asruex has been known for its backdoor capabilities and connection to the spyware DarkHotel. However, when we encountered Asruex in a PDF file, we found that a variant of the malware can also act as an infector particularly through the use of old vulnerabilities CVE-2012-0158 and CVE-2010-2883, which inject code in Word and PDF files respectively.",
+      "meta": {
+        "refs": [
+          "https://blog.trendmicro.com/trendlabs-security-intelligence/asruex-backdoor-variant-infects-word-documents-and-pdfs-through-old-ms-office-and-adobe-vulnerabilities/"
+        ]
+      },
+      "uuid": "b7ad60a0-d648-4775-adec-c78b1a92fc34",
+      "value": "Asruex"
     }
   ],
-  "version": 5
+  "version": 6
 }

clusters/threat-actor.json

@@ -4257,7 +4257,8 @@
           "http://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution",
           "https://www.lookingglasscyber.com/wp-content/uploads/2015/08/Operation_Armageddon_Final.pdf",
           "https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution/",
-          "https://attack.mitre.org/groups/G0047/"
+          "https://attack.mitre.org/groups/G0047/",
+          "https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon"
         ]
       },
       "related": [
@@ -7643,13 +7644,13 @@
       "value": "TA428"
     },
     {
-      "uuid": "e1b95185-8db6-4f3c-9ffd-1749087d934a",
-      "value": "LYCEUM",
       "meta": {
         "refs": [
           "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"
         ]
-      }
+      },
+      "uuid": "e1b95185-8db6-4f3c-9ffd-1749087d934a",
+      "value": "LYCEUM"
     },
     {
       "description": "APT41 is a prolific cyber threat group that carries out Chinese state-sponsored espionage activity in addition to financially motivated activity potentially outside of state control.",