diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8a21c31..1e0e361 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3985,7 +3985,8 @@
           "https://www.secureworks.com/research/threat-profiles/cobalt-gypsy",
           "https://www.fireeye.com/content/dam/collateral/en/mtrends-2018.pdf",
           "https://www.wired.com/story/apt-34-iranian-hackers-critical-infrastructure-companies/",
-          "https://unit42.paloaltonetworks.com/atoms/evasive-serpens/"
+          "https://unit42.paloaltonetworks.com/atoms/evasive-serpens/",
+          "https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"
         ],
         "synonyms": [
           "Twisted Kitten",
@@ -3997,7 +3998,9 @@
           "IRN2",
           "ATK40",
           "G0049",
-          "Evasive Serpens"
+          "Evasive Serpens",
+          "Hazel Sandstorm",
+          "EUROPIUM"
         ],
         "targeted-sector": [
           "Chemical",