diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 0a0b740..a6b3a05 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1645,7 +1645,6 @@
           "Parastoo",
           "iKittens",
           "Group 83",
-          "Newsbeef",
           "NewsBeef",
           "G0058"
         ]
@@ -5597,13 +5596,15 @@
           "https://www.cfr.org/interactive/cyber-operations/magic-hound",
           "https://unit42.paloaltonetworks.com/unit42-magic-hound-campaign-attacks-saudi-targets/",
           "https://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html",
-          "https://www.cfr.org/cyber-operations/apt-35"
+          "https://www.cfr.org/cyber-operations/apt-35",
+          "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/",
+          "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"
         ],
         "synonyms": [
-          "APT 35",
           "Newscaster Team",
           "Magic Hound",
-          "G0059"
+          "G0059",
+          "Phosphorus"
         ]
       },
       "related": [