Turla and APT26 share the same synonym

[frenkiesp]

Hello,
We noticed that the threat actors Turla and APT26 share the same alias/synonym "Hippo Team". How is this possible? Is this a mistake?
Thanks.
Francesco

[adulau]

Interesting. I’ll do a review. Thanks for the notification.

[adulau]

Thanks for the notification, it's now fixed.

[frenkiesp]

Hi Alexandre,
thanks for the fix. We found other six cases that have this issue. I attached a CSV file
misp_shared_aliases.csv

Tanks a lot,
Francesco

[adulau]

Thanks for the CSV and I just quickly reviewed those:

• PLA Navy is more the sponsoring organisation. We should move it in a meta on the three clusters like sponsor-organisation
• Grizzly Steppe is correct to be a synonym for APT28 and APT29
• Andariel is a sub-group of Lazarous group
• Cobalt Gypsy seems to be correct as it's historical with a discovery of multiple IR-sponsored groups
• Golden Chickens seems to be a generic group to describe group 01 and 02 globally