diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 836c812..439c2b6 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7960,7 +7960,7 @@
         ],
         "cfr-type-of-incident": "Espionage",
         "refs": [
-            "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
+          "https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"
         ]
       },
       "uuid": "87af83a4-ced4-4e7c-96a6-86612dc095b1",