diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index f436f37..510d44d 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -412,12 +412,15 @@
           "ZipToken",
           "HIPPOTeam",
           "APT27",
-          "Operation Iron Tiger"
+          "Operation Iron Tiger",
+          "Iron Tiger APT"
         ],
         "country": "CN",
         "refs": [
           "http://www.secureworks.com/cyber-threat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/",
-          "http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/"
+          "http://www.scmagazineuk.com/iran-and-russia-blamed-for-state-sponsored-espionage/article/330401/",
+          "https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/",
+          "https://labs.bitdefender.com/wp-content/uploads/downloads/operation-pzchao-inside-a-highly-specialized-espionage-infrastructure/"
         ]
       },
       "description": "A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.",