From 6ca498872a488593cd8d1e54b29e8d3ba88e38fe Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Mon, 22 Apr 2024 07:48:44 -0700
Subject: [PATCH] [threat-actors] Add GhostR

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 76446f7..ff4a5e9 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -15874,6 +15874,17 @@
       ],
       "uuid": "97c6d972-a3af-4a21-94a2-0f5e09c7320e",
       "value": "UNC3236"
+    },
+    {
+      "description": "Ghostr is a financially motivated threat actor known for stealing a confidential database containing 5.3 million records from the World-Check and leaking about 186GB of data from a stock trading platform. They have been active on Breachforums.is, revealing massive data breaches involving comprehensive details of Thai users, including full names, phone numbers, email addresses, and ID card numbers.",
+      "meta": {
+        "refs": [
+          "https://securityaffairs.com/162136/cyber-crime/hackers-threaten-leak-world-check.html",
+          "https://www.resecurity.com/blog/article/cybercriminals-leaked-massive-volumes-of-stolen-pii-data-from-thailand-in-dark-web"
+        ]
+      },
+      "uuid": "0e4ed0ab-87e2-4588-8fc0-3d720e0efebd",
+      "value": "GhostR"
     }
   ],
   "version": 307