diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2b393d8..4c6449e 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4478,13 +4478,15 @@
           "https://blog.google/threat-analysis-group/continued-cyber-activity-in-eastern-europe-observed-by-tag",
           "https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations",
           "https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign",
-          "https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf"
+          "https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf",
+          "https://www.darkreading.com/attacks-breaches/russian-apt-bluecharlie-swaps-infrastructure-to-evade-detection"
         ],
         "synonyms": [
           "COLDRIVER",
           "SEABORGIUM",
           "TA446",
-          "GOSSAMER BEAR"
+          "GOSSAMER BEAR",
+          "BlueCharlie"
         ]
       },
       "related": [