[threat-actors] add FIN7 aliases

MISP · Jan 24, 2025 · d620bb1 · d620bb1
1 parent 14d4e2e
commit d620bb1
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
@@ -2953,7 +2953,8 @@
           "https://www.secureworks.com/research/threat-profiles/gold-niagara",
           "https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous",
           "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape",
-          "https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/"
+          "https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/",
+          "https://www.wired.com/story/fin7-carbanak-hacking-group-behind-a-string-of-big-breaches/"
         ],
         "synonyms": [
           "CARBON SPIDER",
@@ -2966,7 +2967,8 @@
           "Carbanak",
           "Sangria Tempest",
           "ELBRUS",
-          "Carbon Spider"
+          "Carbon Spider",
+          "JokerStash"
         ]
       },
       "related": [