From 40becc0ee992b47a593dcb9aef993502ff507b85 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Mon, 5 Feb 2024 09:20:10 -0800
Subject: [PATCH] [threat-actors] Add Fishing Elephant

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 63b2352..1f93174 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -14826,6 +14826,17 @@
       },
       "uuid": "07791d89-64b6-46df-9f67-ccde8c2cbb20",
       "value": "ShaggyPanther"
+    },
+    {
+      "description": "Fishing Elephant is a threat actor that primarily targets victims in Bangladesh and Pakistan. They rely on consistent TTPs, including payload and communication patterns, while occasionally incorporating new techniques such as geo-fencing and hiding executables within certificate files. Their tool of choice is AresRAT, which they deliver through platforms like Heroku and Dropbox. Recently, they have shifted their focus to government and diplomatic entities in Turkey, Pakistan, Bangladesh, Ukraine, and China.",
+      "meta": {
+        "refs": [
+          "https://securelist.com/apt-trends-report-q1-2020/96826/",
+          "https://securelist.com/apt-trends-report-q1-2022/106351/"
+        ]
+      },
+      "uuid": "0df34184-4ccf-4357-8e8e-e990058d2992",
+      "value": "Fishing Elephant"
     }
   ],
   "version": 299