diff --git a/clusters/rat.json b/clusters/rat.json
index dd42ee5..c87ed04 100644
--- a/clusters/rat.json
+++ b/clusters/rat.json
@@ -1941,7 +1941,8 @@
         "date": "2005 or 2008",
         "refs": [
           "https://www.lastline.com/labsblog/an-analysis-of-plugx-malware/",
-          "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PLUGX"
+          "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PLUGX",
+          "https://secjoes-reports.s3.eu-central-1.amazonaws.com/Dissecting+PlugX+to+Extract+Its+Crown+Jewels.pdf"
         ],
         "synonyms": [
           "Korplug",
@@ -3536,5 +3537,5 @@
       "value": "Ragnatela"
     }
   ],
-  "version": 39
+  "version": 40
 }