From 613e9feb128f2ebe25cfa80777dc37812664daad Mon Sep 17 00:00:00 2001
From: jstnk9 <joselsm94@gmail.com>
Date: Fri, 13 Oct 2023 10:53:36 +0200
Subject: [PATCH] added suspected victims to Gelsemium

---
 clusters/threat-actor.json | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index eb167f6..1700cda 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9606,6 +9606,26 @@
           "Universities",
           "Religious organization"
         ],
+        "cfr-suspected-victims": [
+          "North Korea",
+          "South Korea",
+          "Japan",
+          "China",
+          "Mongolia",
+          "Egypt",
+          "Saudi Arabia",
+          "Yemen",
+          "Oman",
+          "Iran",
+          "Iraq",
+          "Kuwait",
+          "Israel",
+          "Jordan",
+          "Gaza",
+          "Syria",
+          "Turkey",
+          "Lebanon"
+        ],
         "refs": [
           "https://www.welivesecurity.com/2021/06/09/gelsemium-when-threat-actors-go-gardening/",
           "https://www.venustech.com.cn/uploads/2018/08/231401512426.pdf",