diff --git a/clusters/botnet.json b/clusters/botnet.json
index 8033e87..1af4520 100644
--- a/clusters/botnet.json
+++ b/clusters/botnet.json
@@ -580,7 +580,8 @@
         "date": "August 2016",
         "refs": [
           "https://en.wikipedia.org/wiki/Mirai_(malware)",
-          "https://researchcenter.paloaltonetworks.com/2018/09/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/"
+          "https://researchcenter.paloaltonetworks.com/2018/09/unit42-multi-exploit-iotlinux-botnets-mirai-gafgyt-target-apache-struts-sonicwall/",
+          "https://www.bleepingcomputer.com/news/security/mirai-iot-malware-uses-aboriginal-linux-to-target-multiple-platforms/"
         ]
       },
       "related": [
@@ -814,5 +815,5 @@
       "uuid": "40795af6-b721-11e8-9fcb-570c0b384135"
     }
   ],
-  "version": 10
+  "version": 11
 }
diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 83d8a44..caeb116 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2592,7 +2592,8 @@
           "https://www.cfr.org/interactive/cyber-operations/lazarus-group",
           "https://www.cfr.org/interactive/cyber-operations/operation-ghostsecret",
           "https://securelist.com/operation-applejeus/87553/",
-          "https://www.cfr.org/interactive/cyber-operations/compromise-cryptocurrency-exchanges-south-korea"
+          "https://www.cfr.org/interactive/cyber-operations/compromise-cryptocurrency-exchanges-south-korea",
+          "https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/"
         ],
         "synonyms": [
           "Operation DarkSeoul",
@@ -4033,7 +4034,8 @@
       "description": "A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.",
       "meta": {
         "refs": [
-          "https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/"
+          "https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/",
+          "https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/"
         ],
         "synonyms": [
           "Cobalt group",