From 73eb11fedd02f936cdfdfe12b3c050c42fcaf334 Mon Sep 17 00:00:00 2001
From: Deborah Servili <deborah.servili@gmail.com>
Date: Mon, 12 Mar 2018 10:44:57 +0100
Subject: [PATCH] update Mirage Threat actor

---
 clusters/threat-actor.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index c91c51c..ae1554e 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -523,14 +523,17 @@
           "GREF",
           "Playful Dragon",
           "APT 15",
+          "APT15",
           "Metushy",
           "Lurid",
-          "Social Network Team"
+          "Social Network Team",
+          "Royal APT"
         ],
         "country": "CN",
         "refs": [
           "https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html",
-          "http://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/"
+          "http://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/",
+          "https://github.com/nccgroup/Royal_APT"
         ]
       },
       "value": "Mirage",