From 9ff1b1d2e3679ee2acec188a2e45298dbf254b93 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Mon, 13 Nov 2023 04:36:56 -0800
Subject: [PATCH] [threat-actors] Add WeRedEvils

---
 clusters/threat-actor.json | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index fc03a06..e27239f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12858,6 +12858,18 @@
       },
       "uuid": "4581f930-348e-4054-a71c-863871de66ee",
       "value": "DEV-0950"
+    },
+    {
+      "description": "WeRedEvils is a hacking group that has claimed responsibility for multiple cyber attacks. They targeted the Iranian Electric Grid and the Tasnimnews website, causing the latter to go offline. The group also claimed to have hacked into Iran's oil infrastructure, causing significant damage. They emerged in response to the Hamas massacre and are believed to be a group of Israeli cyber experts.",
+      "meta": {
+        "country": "IL",
+        "refs": [
+          "https://cyberwarzone.com/tasnim-news-hacked-by-weredevils/",
+          "https://www.msspalert.com/news/managed-security-services-provider-mssp-market-news-30-october-2023"
+        ]
+      },
+      "uuid": "7ba756f0-0753-4da9-b00d-8cf35ba84e57",
+      "value": "WeRedEvils"
     }
   ],
   "version": 293