diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index e68961e9..4a8ca809 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -268,7 +268,8 @@
           "Ragebeast",
           "Blackfly",
           "Lead",
-          "Wicked Spider"
+          "Wicked Spider",
+          "Barium"
         ],
         "country": "CN",
         "refs": [
@@ -1444,16 +1445,6 @@
       "value": "Hammer Panda",
       "description": "Hammer Panda is a group of suspected Chinese origin targeting organisations in Russia."
     },
-    {
-      "meta": {
-        "country": "CHN",
-        "refs": [
-          "https://blogs.technet.microsoft.com/mmpc/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp"
-        ]
-      },
-      "value": "Barium",
-      "description": "Barium is one of the groups using Winnti."
-    },
     {
       "meta": {
         "country": "IRN",