From 754a9b08f891d13de0ff4bb1d90f774fa8122068 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Tue, 21 May 2024 06:56:41 -0700
Subject: [PATCH] [threat-actors] Add CiberInteligenciaSV

---
 clusters/threat-actor.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 7785cbd..70ae18d 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -15955,6 +15955,17 @@
       },
       "uuid": "485947c7-edb6-4a07-9276-2114dc767551",
       "value": "PhantomCore"
+    },
+    {
+      "description": "CiberInteligenciaSV is a threat actor that leaked 5.1 million Salvadoran records on Breach Forums. They have also compromised El Salvador's state Bitcoin wallet, Chivo, leaking its source code and VPN credentials. The group aims to obscure their involvement by associating with the Guacamaya group and its proxies.",
+      "meta": {
+        "refs": [
+          "https://securityaffairs.com/162790/data-breach/el-salvador-massive-leak-biometric-data.html",
+          "https://www.cysecurity.news/2024/04/cryptocurrency-chaos-el-salvadors.html"
+        ]
+      },
+      "uuid": "0558bc64-21d9-43e4-8b12-18172d9b5c7d",
+      "value": "CiberInteligenciaSV"
     }
   ],
   "version": 308