From e8854635920733befa962eaf2d8d89d56a940b34 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 7 Nov 2016 16:10:04 +0100
Subject: [PATCH] OilRig added

---
 clusters/threat-actors.json | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/clusters/threat-actors.json b/clusters/threat-actors.json
index 3eaf47d..f01403f 100644
--- a/clusters/threat-actors.json
+++ b/clusters/threat-actors.json
@@ -905,6 +905,10 @@
        "value": "TeamXRat",
        "refs": ["https://securelist.com/blog/research/76153/teamxrat-brazilian-cybercrime-meets-ransomware/"],
        "synonyms": ["CorporacaoXRat","CorporationXRat"]
+     },
+     {
+       "value": "OilRig",
+       "refs": ["http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"]
      }
   ]
 }