diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 26c6667..a30e6e3 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3661,7 +3661,7 @@
         "refs": [
           "https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html",
           "http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/",
-          "http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/",
+          "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/",
           "http://www.clearskysec.com/oilrig/",
           "https://cert.gov.il/Updates/Alerts/SiteAssets/CERT-IL-ALERT-W-120.pdf",
           "http://researchcenter.paloaltonetworks.com/2017/04/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/",
@@ -3676,8 +3676,6 @@
           "https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/",
           "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/",
           "https://www.symantec.com/connect/blogs/shamoon-attacks",
-          "https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html",
-          "https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/",
           "https://www.symantec.com/connect/blogs/shamoon-back-dead-and-destructive-ever",
           "https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/",
           "https://unit42.paloaltonetworks.com/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/",