diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 01ecbff..db3d03b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -6660,8 +6660,8 @@
       "description": "FireEye details APT36 as a Pakistani espionage group that supports Pakistani military and diplomatic interests, targeting Indian military and government. Operations have been also observed in the US, Europe, and Central Asia. Uses social engineering emails, multiple open-source, and custom malware tools.",
       "meta": {
         "refs": [
-          "https://mkd-cirt.mk/wp-content/uploads/2018/08/20181009_3_1_M-Trends2018-May-2018-compressed.pdf"
-          "https://nciipc.gov.in/documents/NCIIPC_Newsletter_July18.pdf"
+          "https://mkd-cirt.mk/wp-content/uploads/2018/08/20181009_3_1_M-Trends2018-May-2018-compressed.pdf",
+          "https://nciipc.gov.in/documents/NCIIPC_Newsletter_July18.pdf",
           "https://aisa.org.au//PDF/AISA%20Sydney%20-%20Dec2016.pdf"
         ],
         "synonyms": [