diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2e9178d..f76a009 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -11978,7 +11978,13 @@
       "meta": {
         "refs": [
           "https://www.team-cymru.com/post/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor",
-          "https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1"
+          "https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1",
+          "https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/",
+          "https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/"
+        ],
+        "synonyms": [
+          "Aggah",
+          "TH-157"
         ]
       },
       "related": [