From 83198aa663d14d3402f22b99b214ff2bec1e0e36 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Tue, 20 Feb 2024 05:22:25 -0800
Subject: [PATCH] [threat-actors] Add ShadowSyndicate

---
 clusters/threat-actor.json | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index dc29ff4..0a0e1d4 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -15218,6 +15218,16 @@
       },
       "uuid": "76dbe26b-8b39-40f5-bc2b-9620004f388e",
       "value": "ResumeLooters"
+    },
+    {
+      "description": "ShadowSyndicate is a threat actor associated with various ransomware groups, using a consistent Secure Shell fingerprint across multiple servers. They have been linked to ransomware families such as Quantum, Nokoyawa, and ALPHV. ShadowSyndicate's infrastructure overlaps with that of Cl0p, suggesting potential connections between the two groups. Their activities indicate they may be a Ransomware-as-a-Service affiliate.",
+      "meta": {
+        "refs": [
+          "https://www.group-ib.com/blog/shadowsyndicate-raas/"
+        ]
+      },
+      "uuid": "24a7e1eb-b7c7-486b-96b2-8d313d65bf70",
+      "value": "ShadowSyndicate"
     }
   ],
   "version": 301