[sebdraven]

This pull request updates several MISP galaxy clusters and the README.md to include newly reported malware, threat actors, and tools, primarily based on threat intelligence published in October 2026. The main focus is on expanding the Android malware, RAT, stealer, threat actor, and tool datasets with new entries and updating element counts accordingly.

Additions to malware and threat actor datasets:

Android malware updates:

• Added six new Android malware entries, including GhostBat RAT, YuanKong RAT, uCreator (aka Baohuo/YingGai), RatHat, and Hirudo, all with detailed descriptions and references to recent threat intelligence. (clusters/android.json, clusters/android.jsonR4948-R5013)
• Bumped the Android cluster version to 26 and updated the element count in the README.md.

RAT and stealer updates:

• Added SiriusQT, a commercial Windows RAT, to the RAT cluster, and incremented the cluster version and count in the README.md. (clusters/rat.json, [1]; [2]
• Added Aokigahara, a Windows infostealer with AI/developer tool targeting, to the stealer cluster, updating the version and count in the README.md. (clusters/stealer.json, [1]; [2]

Threat actor updates:

• Added Jingle Thief, a financially motivated threat cluster involved in gift card fraud, to the threat-actor cluster, with corresponding version and count updates. (clusters/threat-actor.json, [1]; [2]

Tool updates:

• Added Athena StealthRoute and ARToken, two phishing-as-a-service platforms, to the tool cluster, increasing the version and element counts in the README.md. (clusters/tool.json, [1]; [2]

These updates ensure the datasets remain current with the latest threat intelligence and provide more comprehensive coverage for security analysts and automated tooling.

[adulau]

Thank you!