diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b6062de..278e80a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5675,7 +5675,8 @@
           "https://asec.ahnlab.com/en/61082/",
           "https://www.rewterz.com/rewterz-news/rewterz-threat-alert-north-korean-apt-kimsuky-aka-black-banshee-active-iocs-29/",
           "https://www.sentinelone.com/labs/a-glimpse-into-future-scarcruft-campaigns-attackers-gather-strategic-intelligence-and-target-cybersecurity-professionals/",
-          "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html"
+          "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html",
+          "https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-may-16b"
         ],
         "synonyms": [
           "Velvet Chollima",
@@ -5685,7 +5686,8 @@
           "G0086",
           "APT43",
           "Emerald Sleet",
-          "THALLIUM"
+          "THALLIUM",
+          "Springtail"
         ],
         "targeted-sector": [
           "Research - Innovation",