Update May.md

Threat Reports/May.md

@@ -3,6 +3,6 @@
 | --- | --- | --- | --- |
 | 2 MAY | @h2jazi | UAC-0056 (aka TA471, UNC2589, SaintBear, EmberBear) APT activity is using Covid19 as lure to target Ukraine  | [twitter.com/h2jazi](https://twitter.com/h2jazi/status/1520934029519949824) |
 | 2 MAY | TheRecord by Recorded Future | Russia reroutes internet in occupied Ukrainian territory through Russian telcos | [therecord.media](https://therecord.media/ukraine-internet-blackout-kherson-skynet-russia/) |
+| 2 MAY | SSSCIP Ukraine | The official website of Lviv Regional Administration was hit by a concentrated DDoS attack, even though the Russian army is focused on capturing the East. The attack on the Lviv RA website lasted over 12 hours | [cip.gov.ua](https://cip.gov.ua/en/news/rosiiski-khakeri-atakuyut-informaciini-sistemi-po-vsii-krayini-adzhe-meta-rosiyi-zavoyuvati-vsyu-ukrayinu-a-ne-tilki-yiyi-skhid) |
 | 3 MAY | Google TAG | APT28 (FancyBear), Turla, COLDRIVER (Callisto), Ghostwriter (UNC1151), Curious Gorge (China PLA SSF) | [blog.google](https://blog.google/threat-analysis-group/update-on-cyber-activity-in-eastern-europe/) |
 | 3 MAY | Washington Post | CIA instructs Russians on how to share secrets with the spy agency | [washingtonpost.com](https://www.washingtonpost.com/national-security/2022/05/03/cia-russia-agents-recruitment-ukraine/) |
-| 2 MAY | SSSCIP Ukraine | The official website of Lviv Regional Administration was hit by a concentrated DDoS attack, even though the Russian army is focused on capturing the East. The attack on the Lviv RA website lasted over 12 hours | [cip.gov.ua](https://cip.gov.ua/en/news/rosiiski-khakeri-atakuyut-informaciini-sistemi-po-vsii-krayini-adzhe-meta-rosiyi-zavoyuvati-vsyu-ukrayinu-a-ne-tilki-yiyi-skhid) |