diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 79b13cc..c079d45 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4425,11 +4425,13 @@
         "refs": [
           "https://www.symantec.com/connect/blogs/longhorn-tools-used-cyberespionage-group-linked-vault-7",
           "https://www.bleepingcomputer.com/news/security/longhorn-cyber-espionage-group-is-actually-the-cia/",
-          "https://www.cfr.org/interactive/cyber-operations/longhorn"
+          "https://www.cfr.org/interactive/cyber-operations/longhorn",
+          "http://blogs.360.cn/post/APT-C-39_CIA_EN.html"
         ],
         "synonyms": [
           "Lamberts",
-          "the Lamberts"
+          "the Lamberts",
+          "APT-C-39"
         ]
       },
       "related": [