add several refs

clusters/rat.json

@@ -2389,7 +2389,8 @@
           "https://blog.fortinet.com/2017/08/15/a-quick-look-at-a-new-konni-rat-variant",
           "https://www.cylance.com/en_us/blog/threat-spotlight-konni-stealthy-remote-access-trojan.html",
           "https://vallejo.cc/2017/07/08/analysis-of-new-variant-of-konni-rat/",
-          "http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html"
+          "http://blog.talosintelligence.com/2017/07/konni-references-north-korean-missile-capabilities.html",
+          "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
         ],
         "synonyms": [
           "KONNI"
@@ -3255,5 +3256,5 @@
       "value": "NukeSped"
     }
   ],
-  "version": 19
+  "version": 20
 }

clusters/tool.json

@@ -4921,7 +4921,8 @@
       "description": "Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks.  Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.",
       "meta": {
         "refs": [
-          "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"
+          "https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/",
+          "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
         ]
       },
       "uuid": "9e4fd0d3-9736-421c-b1e1-96c1d3665c80",
@@ -5903,7 +5904,8 @@
       "description": "DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.",
       "meta": {
         "refs": [
-          "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf"
+          "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf",
+          "https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/"
         ],
         "synonyms": [
           "FE_APT_RAT_DOGCALL",
@@ -6995,5 +6997,5 @@
       "value": "CoalaBot"
     }
   ],
-  "version": 94
+  "version": 95
 }