diff --git a/clusters/microsoft-activity-group.json b/clusters/microsoft-activity-group.json
index 012e1bd..d611db8 100644
--- a/clusters/microsoft-activity-group.json
+++ b/clusters/microsoft-activity-group.json
@@ -315,6 +315,13 @@
             "estimative-language:likelihood-probability=\"likely\""
           ],
           "type": "uses"
+        },
+        {
+          "dest-uuid": "0125ef58-2675-426f-90eb-0b189961199a",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "uses"
         }
       ],
       "uuid": "d7247cf9-13b6-4781-b789-a5f33521633b",
diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index c929748..b1e8967 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2274,6 +2274,13 @@
             "estimative-language:likelihood-probability=\"likely\""
           ],
           "type": "similar"
+        },
+        {
+          "dest-uuid": "0125ef58-2675-426f-90eb-0b189961199a",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "uses"
         }
       ],
       "uuid": "b2056ff0-00b9-482e-b11c-c771daa5f28a",
@@ -8160,6 +8167,13 @@
             "estimative-language:likelihood-probability=\"likely\""
           ],
           "type": "similar"
+        },
+        {
+          "dest-uuid": "0125ef58-2675-426f-90eb-0b189961199a",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "uses"
         }
       ],
       "uuid": "2ee5ed7a-c4d0-40be-a837-20817474a15b",
diff --git a/clusters/tool.json b/clusters/tool.json
index 1bc037b..3aab56e 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -8711,7 +8711,7 @@
       },
       "related": [
         {
-          "dest-uuid": "54c03b3c-6f97-46ea-a93f-f07bfd5cdd36,",
+          "dest-uuid": "54c03b3c-6f97-46ea-a93f-f07bfd5cdd36",
           "tags": [
             "estimative-language:likelihood-probability=\"likely\""
           ],
@@ -8756,7 +8756,7 @@
       "value": "AHK Bot"
     },
     {
-      "description": "A tool first used in October 2022, abusing the Notion7 service to communicate and download further malicious files. Two versions of this tool have been observed.",
+      "description": "A tool first used in October 2022, abusing the Notion service to communicate and download further malicious files. Two versions of this tool have been observed.\n\nSNOWYAMBER is a dropper that was used in an espionage campaign significantly overlapping with publicly described activity linked to the APT29 and NOBELIUM activity sets. SNOWYAMBER abuses the NOTION collaboration service as a communication channel. It does not contain any other capabilities aside from downloading and executing 2nd stage. To bypass security products, SNOWYAMBER uses several antidetection and obfuscation techniques, including string encryption, dynamic API resolving, EDR/AV unhooking, and direct syscalls.",
       "meta": {
         "refs": [
           "https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services",
@@ -8764,6 +8764,29 @@
           "https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d"
         ]
       },
+      "related": [
+        {
+          "dest-uuid": "b2056ff0-00b9-482e-b11c-c771daa5f28a",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "used-by"
+        },
+        {
+          "dest-uuid": "d7247cf9-13b6-4781-b789-a5f33521633b",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "used-by"
+        },
+        {
+          "dest-uuid": "2ee5ed7a-c4d0-40be-a837-20817474a15b",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "used-by"
+        }
+      ],
       "uuid": "0125ef58-2675-426f-90eb-0b189961199a",
       "value": "SNOWYAMBER"
     },