add BazarCall campaign

clusters/threat-actor.json

@@ -2572,7 +2572,8 @@
           "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf",
           "https://threatintel.blog/OPBlueRaven-Part1/",
           "https://threatintel.blog/OPBlueRaven-Part2/",
-          "https://www.secureworks.com/research/threat-profiles/gold-niagara"
+          "https://www.secureworks.com/research/threat-profiles/gold-niagara",
+          "https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous"
         ],
         "synonyms": [
           "CARBON SPIDER",
@@ -2580,7 +2581,8 @@
           "Calcium",
           "ATK32",
           "G0046",
-          "G0008"
+          "G0008",
+          "Coreid"
         ]
       },
       "related": [
@@ -9894,7 +9896,22 @@
       ],
       "uuid": "8134c96d-d6ed-49cc-99d6-fe74c0636387",
       "value": "GOLD PRELUDE"
+    },
+    {
+      "description": "BazarCall campaigns forgo malicious links or attachments in email messages in favor of phone numbers that recipients are misled into calling. It’s a technique reminiscent of vishing and tech support scams where potential victims are being cold called by the attacker, except in BazarCall’s case, targeted users must dial the number. And when they do, the users are connected with actual humans on the other end of the line, who then provide step-by-step instructions for installing malware into their devices.",
+      "meta": {
+        "refs": [
+          "https://www.trellix.com/en-us/about/newsroom/stories/research/evolution-of-bazarcall-social-engineering-tactics.html",
+          "https://www.microsoft.com/en-us/security/blog/2021/07/29/bazacall-phony-call-centers-lead-to-exfiltration-and-ransomware/"
+        ],
+        "synonyms": [
+          "BazzarCall",
+          "BazaCall"
+        ]
+      },
+      "uuid": "906e2091-cc32-499e-a799-2b9b15e45042",
+      "value": "BazarCall"
     }
   ],
-  "version": 252
+  "version": 253
 }