diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index c91c51c..ae1554e 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -523,14 +523,17 @@
           "GREF",
           "Playful Dragon",
           "APT 15",
+          "APT15",
           "Metushy",
           "Lurid",
-          "Social Network Team"
+          "Social Network Team",
+          "Royal APT"
         ],
         "country": "CN",
         "refs": [
           "https://www.fireeye.com/blog/threat-research/2014/09/forced-to-adapt-xslcmd-backdoor-now-on-os-x.html",
-          "http://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/"
+          "http://arstechnica.com/security/2015/04/elite-cyber-crime-group-strikes-back-after-attack-by-rival-apt-gang/",
+          "https://github.com/nccgroup/Royal_APT"
         ]
       },
       "value": "Mirage",