From 9c502d0d1fc2989c8cb85e71c9f9d62473dd6dd6 Mon Sep 17 00:00:00 2001
From: Mathieu Beligon <mathieu@feedly.com>
Date: Fri, 3 Nov 2023 11:13:11 +0100
Subject: [PATCH] [threat-actors] Add Lancefly

---
 clusters/threat-actor.json | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 058be38..20c7a1a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12227,6 +12227,16 @@
       },
       "uuid": "8e93e09a-734d-4b16-933f-9feb58f6ce7d",
       "value": "GoldenJackal"
+    },
+    {
+      "description": "Lancefly targets government, aviation, and telecom organizations in South and Southeast Asia. They use a custom backdoor named Merdoor, developed since 2018, and employ various tactics to gain access, including phishing emails, SSH credential brute-forcing, and exploiting server vulnerabilities. Additionally, Lancefly has been observed using a newer version of the ZXShell rootkit and tools like PlugX and ShadowPad RAT, which are typically associated with Chinese-speaking APT groups.",
+      "meta": {
+        "refs": [
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lancefly-merdoor-zxshell-custom-backdoor"
+        ]
+      },
+      "uuid": "2ceeab57-85e3-468b-a1b8-c035c496dcdc",
+      "value": "Lancefly"
     }
   ],
   "version": 288