From 0c2b0b76eb06398be1f1ba88e0a46ede05b015ae Mon Sep 17 00:00:00 2001
From: "Daniel Plohmann (jupiter)" <plohmann@informatik.uni-bonn.de>
Date: Wed, 4 Mar 2020 21:09:06 +0100
Subject: [PATCH] while we are at it, we can also do Longhorn = APT-C-39

---
 clusters/threat-actor.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 79b13cc..c079d45 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4425,11 +4425,13 @@
         "refs": [
           "https://www.symantec.com/connect/blogs/longhorn-tools-used-cyberespionage-group-linked-vault-7",
           "https://www.bleepingcomputer.com/news/security/longhorn-cyber-espionage-group-is-actually-the-cia/",
-          "https://www.cfr.org/interactive/cyber-operations/longhorn"
+          "https://www.cfr.org/interactive/cyber-operations/longhorn",
+          "http://blogs.360.cn/post/APT-C-39_CIA_EN.html"
         ],
         "synonyms": [
           "Lamberts",
-          "the Lamberts"
+          "the Lamberts",
+          "APT-C-39"
         ]
       },
       "related": [