From 9fcd3d300c4b130e3429a11d30fc64205ec607b4 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Thu, 16 Jun 2016 03:00:43 +0200
Subject: [PATCH] ScarCruft added

---
 elements/adversary-groups.json | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/elements/adversary-groups.json b/elements/adversary-groups.json
index 5897731..85109bc 100644
--- a/elements/adversary-groups.json
+++ b/elements/adversary-groups.json
@@ -816,6 +816,17 @@
       "refs": [
         "https://citizenlab.org/2016/05/stealth-falcon/"
       ]
+    },
+    {
+      "description": "ScarCruft is a relatively new APT group; victims have been observed in several countries, including Russia, Nepal, South Korea, China, India, Kuwait and Romania. The group has several ongoing operations utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer.",
+      "group": "ScarCruft",
+      "refs": [
+        "https://securelist.com/blog/research/75082/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/"
+      ],
+      "synonyms": [
+       "Operation Daybreak",
+       "Operation Erebus"
+      ]
     }
   ]
 }