From a8c62ddedae09fd1e78b6bd02edcd7bcc808f73c Mon Sep 17 00:00:00 2001
From: Thomas Dupuy <thom4s.d@gmail.com>
Date: Wed, 31 Mar 2021 09:42:40 -0400
Subject: [PATCH] Add Ghostwriter.

---
 clusters/threat-actor.json | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index ed899bc..210060b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -8513,7 +8513,27 @@
       },
       "uuid": "986fcc3f-5f36-4975-bf5f-c42524466bbd",
       "value": "RedEcho"
+    },
+    {
+      "description": "Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.",
+      "meta": {
+        "cfr-suspected-victims": [
+          "Germany",
+          "Latvia",
+          "Lithuania",
+          "Poland"
+        ],
+        "cfr-target-category": [
+          "Government"
+        ],
+        "refs": [
+          "https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html",
+          "https://twitter.com/hatr/status/1377220336597483520"
+        ]
+      },
+      "uuid": "749aaa11-f0fd-416b-bf6c-112f9b5930a5",
+      "value": "Ghostwriter"
     }
   ],
-  "version": 199
+  "version": 200
 }