diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 0298ce3..be80cd7 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -17354,7 +17354,16 @@
         "country": "KP",
         "refs": [
           "https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/",
-          "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"
+          "https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west",
+          "https://unit42.paloaltonetworks.com/fake-north-korean-it-worker-activity-cluster/"
+        ],
+        "synonyms": [
+          "Famous Chollima",
+          "UNC5267",
+          "Wagemole",
+          "Nickel Tapestry",
+          "Contagious Interview",
+          "Storm-1877"
         ]
       },
       "uuid": "09aa3edb-e956-43f0-9fcb-a3154b47d202",