diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index a8893d0..ce5cdfe 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7971,14 +7971,17 @@
           "https://www.mandiant.com/resources/insights/apt-groups",
           "https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf",
           "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi",
-          "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf"
+          "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf",
+          "https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists"
         ],
         "synonyms": [
           "ZIRCONIUM",
           "JUDGMENT PANDA",
           "BRONZE VINEWOOD",
           "Red keres",
-          "Violet Typhoon"
+          "Violet Typhoon",
+          "TA412",
+          "Zirconium"
         ]
       },
       "related": [