diff --git a/clusters/threat-actors.json b/clusters/threat-actors.json
index 17a7b2e..69d29ca 100644
--- a/clusters/threat-actors.json
+++ b/clusters/threat-actors.json
@@ -358,7 +358,8 @@
         "Ke3Chang",
         "GREF",
         "Playful Dragon",
-        "APT 15"
+        "APT 15",
+        "Metushy"
       ]
     },
     {
@@ -634,6 +635,10 @@
     {
       "value": "Turla Group",
       "country": "RU",
+      "refs": [
+        "https://www.first.org/resources/papers/tbilisi2014/turla-operations_and_development.pdf",
+        "https://www.circl.lu/pub/tr-25/"
+      ],
       "synonyms": [
         "Turla",
         "Snake",
@@ -641,7 +646,9 @@
         "Group 88",
         "Waterbug",
         "WRAITH",
-        "Turla Team"
+        "Turla Team",
+        "Uroburos",
+        "Pfinet"
       ]
     },
     {