From ce94cb845886f97c891074242e2dafe2a95ebc50 Mon Sep 17 00:00:00 2001
From: Kafeine <github@dontneedcoffee.com>
Date: Sat, 22 Dec 2018 10:19:52 +0100
Subject: [PATCH] novidade,taurus

---
 clusters/exploit-kit.json | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/clusters/exploit-kit.json b/clusters/exploit-kit.json
index c6489c3..8c5db5c 100644
--- a/clusters/exploit-kit.json
+++ b/clusters/exploit-kit.json
@@ -97,7 +97,7 @@
           "http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-ramps-up-spear-phishing-before-zero-days-get-patched/",
           "https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/"
         ],
-        "status": "Retired - Last seen ",
+        "status": "",
         "synonyms": [
           "Sednit RTF EK"
         ]
@@ -120,6 +120,20 @@
       "uuid": "74fb6a14-1279-4a5b-939a-76478d36d3e1",
       "value": "DNSChanger"
     },
+    {
+      "description": "Novidade Exploit Kit is an exploit kit targeting Routers via the browser",
+      "meta": {
+        "refs": [
+          "https://blog.trendmicro.com/trendlabs-security-intelligence/new-exploit-kit-novidade-found-targeting-home-and-soho-routers/"
+        ],
+        "status": "Active",
+        "synonyms": [
+          "DNSGhost"
+        ]
+      },
+      "uuid": "88acc3b7-2cdd-4e7b-ad0b-2880ffa1eb6d",
+      "value": "Novidade"
+    },
     {
       "description": "Disdain EK has been introduced on underground forum on 2017-08-07. The panel is stolen from Sundown, the pattern are Terror alike and the obfuscation reminds Nebula",
       "meta": {
@@ -201,6 +215,17 @@
       "uuid": "b8be7af8-69a8-11e8-adc0-fa7ae01bbebc",
       "value": "VenomKit"
     },
+    {
+      "description": "Taurus Builder is a tool used to generate malicious MS Word documents that contain macros. The kit is advertised on forums by the user \"badbullzvenom\". ",
+      "meta": {
+        "refs": [
+          ""
+        ],
+        "status": "Active"
+      },
+      "uuid": "63988ca2-46c8-4bda-be46-96a8670af357",
+      "value": "Taurus Builder"
+    },
     {
       "description": "RIG is an exploit kit that takes its source in Infinity EK itself an evolution of Redkit. It became dominant after the fall of Angler, Nuclear Pack and the end of public access to Neutrino. RIG-v is the name given to RIG 4 when it was only accessible by \"vip\" customers and when RIG 3 was still in use.",
       "meta": {
@@ -751,5 +776,5 @@
       "value": "Unknown"
     }
   ],
-  "version": 13
+  "version": 14
 }