From a131a7ce984f5f0e67b1b5e0196d4db40550a698 Mon Sep 17 00:00:00 2001
From: StefanKelm <StefanKelm@users.noreply.github.com>
Date: Wed, 20 Jan 2021 17:43:18 +0100
Subject: [PATCH] Update threat-actor.json

Lazarus
---
 clusters/threat-actor.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2ee4e58..0a1cdbc 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3086,7 +3086,10 @@
           "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/",
           "https://dragos.com/adversaries.html",
           "https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf",
-          "https://www.cfr.org/interactive/cyber-operations/covellite"
+          "https://www.cfr.org/interactive/cyber-operations/covellite",
+          "https://www.hvs-consulting.de/lazarus-report/",
+          "https://github.com/hvs-consulting/ioc_signatures/tree/main/Lazarus_APT37",
+          "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html"
         ],
         "synonyms": [
           "Operation DarkSeoul",
@@ -8439,5 +8442,5 @@
       "value": "UNC2452"
     }
   ],
-  "version": 196
+  "version": 197
 }