diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 1ae67d8..6360dfa 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5553,7 +5553,8 @@
           "https://www.mofa.go.jp/press/danwa/press6e_000312.html",
           "https://www.consilium.europa.eu/en/press/press-releases/2021/07/19/declaration-by-the-high-representative-on-behalf-of-the-eu-urging-china-to-take-action-against-malicious-cyber-activities-undertaken-from-its-territory",
           "https://www.mandiant.com/resources/insights/apt-groups",
-          "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi"
+          "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi",
+          "https://decoded.avast.io/threatintel/outbreak-of-follina-in-australia"
         ],
         "synonyms": [
           "TEMP.Periscope",