diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 50582e6..b4923fb 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3613,7 +3613,8 @@
           "https://blog.checkpoint.com/2015/06/09/new-data-volatile-cedar/",
           "https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/",
           "https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf",
-          "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"
+          "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf",
+          "https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/"
         ],
         "suspected-victims": [
           "Middle East",
@@ -3622,7 +3623,8 @@
           "Saudi Arabia"
         ],
         "synonyms": [
-          "Lebanese Cedar"
+          "Lebanese Cedar",
+          "DeftTorero"
         ]
       },
       "related": [
@@ -9884,5 +9886,5 @@
       "value": "APT-Q-12"
     }
   ],
-  "version": 249
+  "version": 250
 }