diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 3197fee..c7d03b7 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9,7 +9,8 @@
           "Advanced Persistent Threat 1",
           "Byzantine Candor",
           "Group 3",
-          "TG-8223"
+          "TG-8223",
+          "Comment Group"
         ],
         "country": "CN",
         "refs": [
@@ -670,7 +671,9 @@
         "synonyms": [
           "Operation Cleaver",
           "Tarh Andishan",
-          "Alibaba"
+          "Alibaba",
+          "2889",
+          "TG-2889"
         ],
         "refs": [
           "http://cdn2.hubspot.net/hubfs/270968/assets/Cleaver/Cylance_Operation_Cleaver_Report.pdf"
@@ -1100,6 +1103,10 @@
     },
     {
       "meta": {
+        "synonyms": [
+          "TG-3390",
+          "Emissary Panda"
+        ],
         "refs": [
           "http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/",
           "https://attack.mitre.org"