diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index c87410cc..6ec6e3c8 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5853,7 +5853,10 @@
         "refs": [
           "https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/",
           "https://mobile.twitter.com/360TIC/status/1083289987339042817",
-          "https://ti.360.net/blog/articles/latest-target-attack-of-darkhydruns-group-against-middle-east-en/"
+          "https://ti.360.net/blog/articles/latest-target-attack-of-darkhydruns-group-against-middle-east-en/",
+          "https://unit42.paloaltonetworks.com/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/",
+          "https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/",
+          "https://attack.mitre.org/groups/G0079/"
         ],
         "synonyms": [
           "LazyMeerkat"