From 927b55b36393ffa9b411801efd5edeacd952c02f Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 9 Jan 2025 03:10:46 -0800
Subject: [PATCH] [threat-actors] Add FIN6 aliases

---
 clusters/threat-actor.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8d45b84..235688b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3939,7 +3939,9 @@
           "https://attack.mitre.org/groups/G0037/",
           "https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/",
           "http://www.secureworks.com/research/threat-profiles/gold-franklin",
-          "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/"
+          "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/",
+          "https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta4557-targets-recruiters-directly-email",
+          "https://www.proofpoint.com/us/threat-insight/post/fake-jobs-campaigns-delivering-moreeggs-backdoor-fake-job-offers"
         ],
         "synonyms": [
           "SKELETON SPIDER",
@@ -3949,7 +3951,8 @@
           "GOLD FRANKLIN",
           "ATK88",
           "G0037",
-          "Camouflage Tempest"
+          "Camouflage Tempest",
+          "TA4557"
         ]
       },
       "related": [