From 5f274f58c926257328fe3853ddc8421032484240 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Mon, 13 Feb 2023 11:44:56 -0800
Subject: [PATCH] [threat-actors] Add Moskalvzapoe

---
 clusters/threat-actor.json | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 71a1731..7140f94 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10003,6 +10003,37 @@
       ],
       "uuid": "ba57c28a-47d0-46ba-a933-9aed69f7b84f",
       "value": "Malteiro"
+    },
+    {
+      "meta": {
+        "references": [
+          "https://medium.com/walmartglobaltech/man1-moskal-hancitor-and-a-side-of-ransomware-d77b4d991618",
+          "https://vixra.org/abs/1902.0257",
+          "https://unit42.paloaltonetworks.com/hancitor-infections-cobalt-strike/",
+          "https://unit42.paloaltonetworks.com/threat-brief-hancitor-actors/"
+        ],
+        "synonyms": [
+          "MAN1",
+          "TA511"
+        ]
+      },
+      "related": [
+        {
+          "dest-uuid": "4166ab63-24b0-4448-92ea-21c8deef978d",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        },
+        {
+          "dest-uuid": "ef2247bf-8062-404b-894f-d65d00564817",
+          "tags": [
+            "estimative-language:likelihood-probability=\"very-likely\""
+          ],
+          "type": "uses"
+        }
+      ],
+      "value": "Moskalvzapoe"
     }
   ],
   "version": 258