diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 431db842..69ba274d 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9253,7 +9253,9 @@
       "description": "Cosmic Lynx is a Russia-based BEC cybercriminal organization that has significantly impacted the email threat landscape with sophisticated, high-dollar phishing attacks.",
       "meta": {
         "cfr-type-of-incident": "Business Email Compromise",
-        "refs": "https://www.agari.com/cyber-intelligence-research/whitepapers/acid-agari-cosmic-lynx.pdf"
+        "refs": [
+          "https://www.agari.com/cyber-intelligence-research/whitepapers/acid-agari-cosmic-lynx.pdf"
+        ]
       },
       "uuid": "54ae5c75-8aab-41a8-971a-03d53db9b35c",
       "value": "Cosmic Lynx"