diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index ada6030..a3cedba 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5836,7 +5836,6 @@
           "https://arstechnica.com/information-technology/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/",
           "https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/",
           "https://securelist.com/luckymouse-hits-national-data-center/86083/",
-          "https://www.secureworks.com/research/bronze-union",
           "https://attack.mitre.org/groups/G0027/"
         ],
         "synonyms": [
@@ -5845,7 +5844,6 @@
           "APT 27",
           "Threat Group 3390",
           "Bronze Union",
-          "ZipToken",
           "Iron Tiger",
           "TG-3390",
           "TEMP.Hippo",