From 4ff0bdfe8e5566caed8db1c4ec2f7da118c63fe2 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Tue, 13 Sep 2022 11:34:02 -0700
Subject: [PATCH] [threat-actors] Clean TA505 aliases

---
 clusters/threat-actor.json | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 9fd1ae4..8b34790 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -6442,14 +6442,14 @@
           "https://www.secureworks.com/research/threat-profiles/gold-tahoe",
           "https://www.telekom.com/en/blog/group/article/eager-beaver-a-short-overview-of-the-restless-threat-actor-ta505-609546",
           "https://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/",
-          "https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic"
+          "https://www.secureworks.com/blog/how-cyber-adversaries-are-adapting-to-exploit-the-global-pandemic",
+          "https://cyberthreat.thalesgroup.com/attackers/ATK103"
         ],
         "synonyms": [
           "SectorJ04 Group",
           "GRACEFUL SPIDER",
           "GOLD TAHOE",
           "Dudear",
-          "TEMP.Warlock",
           "G0092",
           "ATK103"
         ]
@@ -8061,8 +8061,7 @@
         ],
         "synonyms": [
           "TEMP.Warlock",
-          "UNC902",
-          "GRACEFUL SPIDER"
+          "UNC902"
         ]
       },
       "uuid": "c01aadc6-1087-4e8e-8d5c-a27eba409fe3",