From 73c73606ff4bd80325681742dab727240c595738 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Fri, 3 Nov 2023 11:13:11 +0100
Subject: [PATCH] [threat-actors] Add GoldenJackal

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8931e05..058be38 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12216,6 +12216,17 @@
       },
       "uuid": "1f7f4a51-c4a8-4365-ade3-83b222e7cb67",
       "value": "Earth Estries"
+    },
+    {
+      "description": "GoldenJackal activity is characterized by the use of compromised WordPress websites as a method to host C2-related logic. Kaspersky believes the attackers upload a malicious PHP file that is used as a relay to forward web requests to another backbone C2 server. They developed a collection of .NET malware tools known as Jackal.",
+      "meta": {
+        "refs": [
+          "https://securelist.com/it-threat-evolution-q2-2023/110355/",
+          "https://securelist.com/goldenjackal-apt-group/109677/"
+        ]
+      },
+      "uuid": "8e93e09a-734d-4b16-933f-9feb58f6ce7d",
+      "value": "GoldenJackal"
     }
   ],
   "version": 288