diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 338ce26..eaba972 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -13655,7 +13655,12 @@
         "refs": [
           "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/",
           "https://web-assets.esetstatic.com/wls/2023/01/eset_apt_activity_report_t32022.pdf",
-          "https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/"
+          "https://blog.sekoia.io/my-teas-not-cold-an-overview-of-china-cyber-threat/",
+          "https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html",
+          "https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"
+        ],
+        "synonyms": [
+          "Earth Kasha"
         ]
       },
       "uuid": "e992d874-604b-4a09-9c6c-0319d5be652a",