From 6ddf39e1aee5ca93d7f7a25c217c9c78502d0c16 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Tue, 20 Feb 2024 05:22:25 -0800
Subject: [PATCH] [threat-actors] Add Charming Kitten aliases

---
 clusters/threat-actor.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8602409..27d998a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1810,7 +1810,8 @@
           "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/",
           "https://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf",
           "https://attack.mitre.org/groups/G0058/",
-          "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"
+          "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf",
+          "https://www.volexity.com/blog/2024/02/13/charmingcypress-innovating-persistence/"
         ],
         "synonyms": [
           "Newscaster",
@@ -1818,7 +1819,8 @@
           "iKittens",
           "Group 83",
           "NewsBeef",
-          "G0058"
+          "G0058",
+          "CharmingCypress"
         ],
         "targeted-sector": [
           "Defense",