diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2aab5fe..db3d03b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -6660,7 +6660,9 @@
       "description": "FireEye details APT36 as a Pakistani espionage group that supports Pakistani military and diplomatic interests, targeting Indian military and government. Operations have been also observed in the US, Europe, and Central Asia. Uses social engineering emails, multiple open-source, and custom malware tools.",
       "meta": {
         "refs": [
-          "https://mkd-cirt.mk/wp-content/uploads/2018/08/20181009_3_1_M-Trends2018-May-2018-compressed.pdf"
+          "https://mkd-cirt.mk/wp-content/uploads/2018/08/20181009_3_1_M-Trends2018-May-2018-compressed.pdf",
+          "https://nciipc.gov.in/documents/NCIIPC_Newsletter_July18.pdf",
+          "https://aisa.org.au//PDF/AISA%20Sydney%20-%20Dec2016.pdf"
         ],
         "synonyms": [
           "APT 36",