From bef50816a4b8a9a06d0b7a1731c6397db6a87df2 Mon Sep 17 00:00:00 2001
From: Mathieu4141 <mathieu@feedly.com>
Date: Wed, 20 Mar 2024 10:23:42 -0700
Subject: [PATCH] [threat-actors] Add MuddyWater aliases

---
 clusters/threat-actor.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5cbfc37..26922b1 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -6285,7 +6285,8 @@
           "https://attack.mitre.org/groups/G0069/",
           "http://www.secureworks.com/research/threat-profiles/cobalt-ulster",
           "https://unit42.paloaltonetworks.com/atoms/boggyserpens/",
-          "https://www.sentinelone.com/blog/the-new-frontline-of-geopolitics-understanding-the-rise-of-state-sponsored-cyber-attacks/"
+          "https://www.sentinelone.com/blog/the-new-frontline-of-geopolitics-understanding-the-rise-of-state-sponsored-cyber-attacks/",
+          "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
         ],
         "synonyms": [
           "TEMP.Zagros",
@@ -6297,7 +6298,8 @@
           "ATK51",
           "Boggy Serpens",
           "Mango Sandstorm",
-          "TA450"
+          "TA450",
+          "Earth Vetala"
         ]
       },
       "related": [