diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b6e836a..879b86f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7288,11 +7288,14 @@
           "https://www.justice.gov/usao-sdny/pr/nine-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic",
           "https://www.justice.gov/opa/pr/nine-iranians-charged-conducting-massive-cyber-theft-campaign-behalf-islamic-revolutionary",
           "https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again",
-          "https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities"
+          "https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities",
+          "https://www.proofpoint.com/us/threat-insight/post/seems-phishy-back-school-lures-target-university-students-and-staff",
+          "https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"
         ],
         "synonyms": [
           "COBALT DICKENS",
-          "Mabna Institute"
+          "Mabna Institute",
+          "TA407"
         ]
       },
       "uuid": "5059b44d-2753-4977-b987-4922f09afe6b",