diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8fb9360..a00fe33 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2798,7 +2798,9 @@
           "https://www.welivesecurity.com/2017/05/23/xdata-ransomware-making-rounds-amid-global-wannacryptor-scare",
           "https://www.welivesecurity.com/2017/06/27/new-ransomware-attack-hits-ukraine",
           "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back",
-          "https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/"
+          "https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/",
+          "https://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine",
+          "https://cert.gov.ua/article/405538"
         ],
         "synonyms": [
           "Quedagh",
@@ -2810,7 +2812,8 @@
           "TeleBots",
           "IRIDIUM",
           "Blue Echidna",
-          "FROZENBARENTS"
+          "FROZENBARENTS",
+          "UAC-0113"
         ],
         "targeted-sector": [
           "Electric",
@@ -4748,14 +4751,16 @@
           "https://www.microsoft.com/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations",
           "https://blog.sekoia.io/calisto-continues-its-credential-harvesting-campaign",
           "https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf",
-          "https://www.darkreading.com/attacks-breaches/russian-apt-bluecharlie-swaps-infrastructure-to-evade-detection"
+          "https://www.darkreading.com/attacks-breaches/russian-apt-bluecharlie-swaps-infrastructure-to-evade-detection",
+          "https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"
         ],
         "synonyms": [
           "COLDRIVER",
           "SEABORGIUM",
           "TA446",
           "GOSSAMER BEAR",
-          "BlueCharlie"
+          "BlueCharlie",
+          "Star Blizzard"
         ],
         "targeted-sector": [
           "Government, Administration",
@@ -11975,7 +11980,13 @@
       "meta": {
         "refs": [
           "https://www.team-cymru.com/post/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor",
-          "https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1"
+          "https://otx.alienvault.com/pulse/62cfe4ef3415be5f83be81d1",
+          "https://team-cymru.com/blog/2022/07/12/an-analysis-of-infrastructure-linked-to-the-hagga-threat-actor/",
+          "https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/"
+        ],
+        "synonyms": [
+          "Aggah",
+          "TH-157"
         ]
       },
       "related": [