From b0f0bbae33caf5ff6295bcd93ee25abe7eb8d6f5 Mon Sep 17 00:00:00 2001
From: Daniel Plohmann <daniel.plohmann@mailbox.org>
Date: Thu, 23 Apr 2020 14:52:08 +0200
Subject: [PATCH] adding VOYEUR as alias (used by NSA) for MAGIC KITTEN (source
 reference included)

---
 clusters/threat-actor.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b72f522..f7f5b28 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2017,10 +2017,12 @@
         "attribution-confidence": "50",
         "country": "IR",
         "refs": [
-          "http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/"
+          "http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/",
+          "https://carnegieendowment.org/2018/01/04/iran-s-cyber-ecosystem-who-are-threat-actors-pub-75140"
         ],
         "synonyms": [
-          "Group 42"
+          "Group 42",
+          "VOYEUR"
         ]
       },
       "uuid": "2e77511d-f72f-409e-9b64-e2a15efe9bf4",