diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5b50671..d27bfad 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3478,7 +3478,9 @@
           "https://cysinfo.com/cyber-attack-targeting-cbi-and-possibly-indian-army-officials",
           "https://s.tencent.com/research/report/669.html",
           "https://www.fireeye.com/blog/threat-research/2016/06/apt_group_sends_spea.html",
-          "https://www.secureworks.com/research/threat-profiles/copper-fieldstone"
+          "https://www.secureworks.com/research/threat-profiles/copper-fieldstone",
+          "https://www.trendmicro.com/en_us/research/22/a/investigating-apt36-or-earth-karkaddans-attack-chain-and-malware.html",
+          "https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/"
         ],
         "synonyms": [
           "C-Major",
@@ -3489,7 +3491,8 @@
           "APT 36",
           "TMP.Lapis",
           "Green Havildar",
-          "COPPER FIELDSTONE"
+          "COPPER FIELDSTONE",
+          "Earth Karkaddan"
         ],
         "targeted-sector": [
           "Activists",