From e41f6aec42c789bbbdb4848a95d1a61f80f779a5 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Fri, 15 Nov 2024 03:42:17 -0800
Subject: [PATCH] [threat-actors] Add WageMole aliases

---
 clusters/threat-actor.json | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 0298ce3a..be80cd79 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -17354,7 +17354,16 @@
         "country": "KP",
         "refs": [
           "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/",
-          "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"
+          "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west",
+          "https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/"
+        ],
+        "synonyms": [
+          "Famous Chollima",
+          "UNC5267",
+          "Wagemole",
+          "Nickel Tapestry",
+          "Contagious Interview",
+          "Storm-1877"
         ]
       },
       "uuid": "09aa3edb-e956-43f0-9fcb-a3154b47d202",