diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 34712fe..7ecd35b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7949,10 +7949,17 @@
       "meta": {
         "refs": [
           "https://securelist.com/apt-trends-report-q1-2018/85280/",
-          "https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/"
+          "https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/",
+          "https://s.tencent.com/research/report/659.html",
+          "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/fireeye-sidewinder-targeted-attack.pdf",
+          "https://s.tencent.com/research/report/479.html",
+          "https://medium.com/@Sebdraven/apt-sidewinder-tricks-powershell-anti-forensics-and-execution-side-loading-5bc1a7e7c84c"
         ],
         "synonyms": [
-          "RAZOR TIGER"
+          "RAZOR TIGER",
+          "Rattlesnake",
+          "APT-C-17",
+          "T-APT-04"
         ]
       },
       "uuid": "c4ce1174-9462-47e9-8038-794f40a184b3",