From 49c3e06605dd3ebc27c5bd8f8c5f9304ddfaa55f Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 1 Feb 2024 11:02:02 -0800
Subject: [PATCH] [threat-actors] Add FIN7 aliases

---
 clusters/threat-actor.json | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index ab881e1..9900145 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2916,7 +2916,8 @@
           "https://threatintel.blog/OPBlueRaven-Part2/",
           "https://www.secureworks.com/research/threat-profiles/gold-niagara",
           "https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous",
-          "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape"
+          "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape",
+          "https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/"
         ],
         "synonyms": [
           "CARBON SPIDER",
@@ -2926,7 +2927,10 @@
           "G0046",
           "G0008",
           "Coreid",
-          "Carbanak"
+          "Carbanak",
+          "Sangria Tempest",
+          "ELBRUS",
+          "Carbon Spider"
         ]
       },
       "related": [