From 2ea560f9a7a0d5dc7022a4ff21b96dd71787ef81 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Mon, 15 Oct 2018 12:02:21 +0200
Subject: [PATCH] add refs & synonyms

---
 clusters/threat-actor.json | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 68f0bc2..6f2d28c 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4933,15 +4933,21 @@
           "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf",
           "http://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html",
           "https://twitter.com/mstoned7/status/966126706107953152",
-          "https://www.cfr.org/interactive/cyber-operations/apt-37"
+          "https://www.cfr.org/interactive/cyber-operations/apt-37",
+          "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
         ],
         "synonyms": [
           "APT 37",
           "Group 123",
+          "Group123",
           "Starcruft",
           "Reaper",
+          "Reaper Group",
           "Red Eyes",
-          "Ricochet Chollima"
+          "Ricochet Chollima",
+          "StarCruft",
+          "Operation Daybreak",
+          "Operation Erebus."
         ]
       },
       "related": [
@@ -5943,5 +5949,5 @@
       "value": "Roaming Mantis"
     }
   ],
-  "version": 71
+  "version": 72
 }