diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 0053c0f..8d58210 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3215,7 +3215,8 @@
           "https://attack.mitre.org/groups/G0082",
           "https://attack.mitre.org/groups/G0032",
           "https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/",
-          "https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds"
+          "https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds",
+          "https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists"
         ],
         "synonyms": [
           "Operation DarkSeoul",
@@ -3253,7 +3254,9 @@
           "Diamond Sleet",
           "ZINC",
           "Sapphire Sleet",
-          "COPERNICIUM"
+          "COPERNICIUM",
+          "TA404",
+          "Lazarus group"
         ]
       },
       "related": [