diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index f451f33..3be5954 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10068,7 +10068,9 @@
           "https://www.fortinet.com/blog/threat-research/guard-your-drive-from-driveguard"
         ],
         "synonyms": [
-          "Moses Staff"
+          "Moses Staff",
+          "Marigold Sandstorm",
+          "DEV-0500"
         ]
       },
       "related": [