From 59799a2a7e2246c71f172eeef3e33e720ffb8b50 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Fri, 22 Apr 2016 22:28:38 +0200
Subject: [PATCH] SPIVY added

---
 elements/threat-actor-tools.json | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index de03a80..e87efd1 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -12,6 +12,11 @@
       "description": "Poison Ivy is a RAT which was freely available and first released in 2005.",
       "refs": ["https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf"]
     },
+    {
+      "value": "SPIVY",
+      "description": "In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.",
+      "refs": ["http://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/"]
+    },
     {
       "value": "Torn RAT"
     },