diff --git a/clusters/microsoft-activity-group.json b/clusters/microsoft-activity-group.json
index b0e4b6a..bd12546 100644
--- a/clusters/microsoft-activity-group.json
+++ b/clusters/microsoft-activity-group.json
@@ -492,21 +492,8 @@
         "sector": "Iran",
         "synonyms": [
           "NEPTUNIUM",
-          "Vice Leaker"
-        ]
-      },
-      "uuid": "b06ff51a-77e7-5b7f-9938-4a2d37bce5a4",
-      "value": "Cotton Sandstorm"
-    },
-    {
-      "meta": {
-        "refs": [
-          "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
-        ],
-        "sector": "Iran",
-        "synonyms": [
-          "DEV-0198 (NEPTUNIUM)",
-          "Vice Leaker"
+          "Vice Leaker",
+          "DEV-0198"
         ]
       },
       "uuid": "b06ff51a-77e7-5b7f-9938-4a2d37bce5a4",