From faa4581e2742535bd96b904f2224d7f20496562b Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Tue, 12 Nov 2024 06:58:58 -0800
Subject: [PATCH] [threat-actors] Add EvilWeb

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5601cb9a..f38f564a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -17260,6 +17260,17 @@
       ],
       "uuid": "75d2d875-6e49-4152-b055-62337b0a22df",
       "value": "Operation Cobalt Whisper"
+    },
+    {
+      "description": "EvilWeb is a pro-Russian hacktivist group created in March 2024 that targets American and European entities using a hack-and-leak method alongside DDoS attacks. The group claims to have obtained data from various high-profile American organizations. EvilWeb announced its participation in the #FreeDurov operation on August 25, 2024, and began executing DDoS and hacking attacks. As of September 3, 2024, their Telegram channel has 1,146 members.",
+      "meta": {
+        "country": "RU",
+        "refs": [
+          "https://blog.checkpoint.com/security/hacktivists-call-for-release-of-telegram-founder-with-freedurov-ddos-campaign/"
+        ]
+      },
+      "uuid": "c8ade1b0-befd-490e-8888-656dffee4d1c",
+      "value": "EvilWeb"
     }
   ],
   "version": 320