diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index e4eb11c..b98b00b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7604,10 +7604,16 @@
       "meta": {
         "refs": [
           "https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign",
-          "https://www.secureworks.com/research/threat-profiles/cobalt-lyceum"
+          "https://www.secureworks.com/research/threat-profiles/cobalt-lyceum",
+          "https://www.prevailion.com/latest-targets-of-cyber-group-lyceum/",
+          "https://www.clearskysec.com/siamesekitten/",
+          "https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"
         ],
         "synonyms": [
-          "COBALT LYCEUM"
+          "COBALT LYCEUM",
+          "HEXANE",
+          "Spirlin",
+          "siamesekitten"
         ]
       },
       "uuid": "e1b95185-8db6-4f3c-9ffd-1749087d934a",
@@ -8875,5 +8881,5 @@
       "value": "Common Raven"
     }
   ],
-  "version": 207
+  "version": 208
 }