From 02530c305a4bd34918a94651595efab95f78fbb1 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Tue, 31 May 2016 22:43:37 +0200
Subject: [PATCH] HerHer Trojan and Helminth Backdoor added

---
 elements/threat-actor-tools.json | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index c2fe0c4..4193d92 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -436,6 +436,14 @@
     {
       "value": "Ruckguv",
       "refs": ["https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear"]
+    },
+    {
+      "value": "HerHer Trojan",
+      "refs": ["http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"]
+    },
+    {
+      "value": "Helminth backdoor",
+      "refs": ["http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"],
     }
   ],
   "version" : 1,