diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 1b6498a..fd0711b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9861,14 +9861,14 @@
       "meta": {
         "country": "CN",
         "refs": [
-	  "https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf",
+          "https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf",
           "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself",
           "https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation",
           "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility",
           "https://twitter.com/cglyer/status/1480734487000453121"
         ],
         "synonyms": [
-	  "SLIME34",
+          "SLIME34",
           "DEV-0401"
         ]
       },
@@ -10033,7 +10033,7 @@
         ],
         "country": "CN",
         "refs": [
-	  "https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf",
+          "https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf",
           "https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf"
         ]
       },