From 49f8f60a85d21f9518c5173002cd2697fa2b97e3 Mon Sep 17 00:00:00 2001
From: StefanKelm <StefanKelm@users.noreply.github.com>
Date: Thu, 29 Aug 2019 13:13:00 +0200
Subject: [PATCH] Update threat-actor.json

Add ITG08 as synonym for FIN6
---
 clusters/threat-actor.json | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 7250d68..222569b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3735,10 +3735,12 @@
         "refs": [
           "https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf",
           "https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html",
-          "https://attack.mitre.org/groups/G0037/"
+          "https://attack.mitre.org/groups/G0037/",
+          "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"
         ],
         "synonyms": [
-          "Skeleton Spider"
+          "Skeleton Spider",
+          "ITG08"
         ]
       },
       "related": [
@@ -7698,5 +7700,5 @@
       "value": "APT41"
     }
   ],
-  "version": 128
+  "version": 129
 }