From 2dc29dc6c704a93a32e1535830c69158dc809554 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 1 Feb 2024 11:02:00 -0800
Subject: [PATCH] [threat-actors] Add WIZARD SPIDER aliases

---
 clusters/threat-actor.json | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 3be5954..034e3dc 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7469,12 +7469,21 @@
           "https://www.secureworks.com/blog/trickbot-modifications-target-us-mobile-users",
           "http://www.secureworks.com/research/threat-profiles/gold-blackburn",
           "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf",
-          "https://www.prodaft.com/m/reports/WizardSpider_TLPWHITE_v.1.4.pdf"
+          "https://www.prodaft.com/m/reports/WizardSpider_TLPWHITE_v.1.4.pdf",
+          "https://securityintelligence.com/posts/itg23-crypters-cooperation-between-cybercriminal-groups/",
+          "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
         ],
         "synonyms": [
           "TEMP.MixMaster",
           "GOLD BLACKBURN",
-          "FIN12"
+          "FIN12",
+          "Periwinkle Tempest",
+          "DEV-0193",
+          "Storm-0193",
+          "Trickbot LLC",
+          "UNC2053",
+          "Pistachio Tempest",
+          "DEV-0237"
         ]
       },
       "related": [