From 38fea405f5e70c3a1fa773e746e772abf3c5f931 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 1 Feb 2024 11:01:56 -0800
Subject: [PATCH] [threat-actors] Add DEV-0586 aliases

---
 clusters/threat-actor.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4f5d076..b75494f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10464,13 +10464,16 @@
           "Ukraine"
         ],
         "cfr-type-of-incident": "Sabotage",
+        "country": "RU",
         "refs": [
           "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/",
           "https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/",
-          "https://unit42.paloaltonetworks.com/atoms/ruinousursa/"
+          "https://unit42.paloaltonetworks.com/atoms/ruinousursa/",
+          "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
         ],
         "synonyms": [
-          "Ruinous Ursa"
+          "Ruinous Ursa",
+          "Cadet Blizzard"
         ]
       },
       "related": [