From 1f6b606f75c1ce323ab797839885b2b9f0bfa0b6 Mon Sep 17 00:00:00 2001
From: Daniel Plohmann <daniel.plohmann@mailbox.org>
Date: Wed, 7 Nov 2018 17:19:50 +0100
Subject: [PATCH] added APT38 as (FireEye) alias for Lazarus

cross-references in https://content.fireeye.com/apt/rpt-apt38 suggest the link to Lazarus.
---
 clusters/threat-actor.json | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 9574a5c..bdc230e 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2637,7 +2637,8 @@
           "https://www.cfr.org/interactive/cyber-operations/operation-ghostsecret",
           "https://securelist.com/operation-applejeus/87553/",
           "https://www.cfr.org/interactive/cyber-operations/compromise-cryptocurrency-exchanges-south-korea",
-          "https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/"
+          "https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/",
+          "https://content.fireeye.com/apt/rpt-apt38"
         ],
         "synonyms": [
           "Operation DarkSeoul",
@@ -2653,7 +2654,8 @@
           "Labyrinth Chollima",
           "Operation Troy",
           "Operation GhostSecret",
-          "Operation AppleJeus"
+          "Operation AppleJeus",
+          "APT38"
         ]
       },
       "related": [
@@ -5999,5 +6001,5 @@
       "value": "EvilTraffic"
     }
   ],
-  "version": 76
+  "version": 77
 }