diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index c01742b..59c0498 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -16110,7 +16110,13 @@
       "meta": {
         "country": "RU",
         "refs": [
-          "https://blog.cloudflare.com/disrupting-flyingyeti-campaign-targeting-ukraine"
+          "https://blog.cloudflare.com/disrupting-flyingyeti-campaign-targeting-ukraine",
+          "https://www.microsoft.com/en-us/security/blog/2024/12/11/frequent-freeloader-part-ii-russian-actor-secret-blizzard-using-tools-of-other-groups-to-attack-ukraine/",
+          "https://www.cloudflare.com/threat-intelligence/research/report/disrupting-flyingyetis-campaign-targeting-ukrainev/"
+        ],
+        "synonyms": [
+          "Storm-1837",
+          "Flying Yeti"
         ]
       },
       "uuid": "1dcbad05-c5b7-4ec3-8920-45f396554f7a",