diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2d88401..c13287a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10413,13 +10413,15 @@
           "https://www.bitdefender.com/files/News/CaseStudies/study/352/Bitdefender-PR-Whitepaper-BitterAPT-creat4571-en-EN-GenericUse.pdf",
           "https://mp.weixin.qq.com/s/8j_rHA7gdMxY1_X8alj8Zg",
           "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf",
-          "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html"
+          "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html",
+          "https://www.proofpoint.com/us/blog/threat-insight/hidden-plain-sight-ta397s-new-attack-chain-delivers-espionage-rats"
         ],
         "synonyms": [
           "Bitter",
           "T-APT-17",
           "APT-C-08",
-          "Orange Yali"
+          "Orange Yali",
+          "TA397"
         ]
       },
       "uuid": "1e9bd6fe-e009-41ce-8e92-ad78c73ee772",