From 9e940af919a4aa3591e177f2e8b0997de2a453b0 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Thu, 1 Feb 2024 11:01:59 -0800
Subject: [PATCH] [threat-actors] Add OilRig aliases

---
 clusters/threat-actor.json | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8a21c31..1e0e361 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3985,7 +3985,8 @@
           "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy",
           "https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf",
           "https://www.wired.com/story/apt-34-iranian-hackers-critical-infrastructure-companies/",
-          "https://unit42.paloaltonetworks.com/atoms/evasive-serpens/"
+          "https://unit42.paloaltonetworks.com/atoms/evasive-serpens/",
+          "https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"
         ],
         "synonyms": [
           "Twisted Kitten",
@@ -3997,7 +3998,9 @@
           "IRN2",
           "ATK40",
           "G0049",
-          "Evasive Serpens"
+          "Evasive Serpens",
+          "Hazel Sandstorm",
+          "EUROPIUM"
         ],
         "targeted-sector": [
           "Chemical",