diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 3ede597..64cc039 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4119,12 +4119,14 @@
         "refs": [
           "https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/",
           "https://www.bleepingcomputer.com/news/security/cobalt-hacking-group-tests-banks-in-russia-and-romania/",
-          "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"
+          "https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish",
+          "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-september-cobalt-spider/"
         ],
         "synonyms": [
           "Cobalt group",
           "Cobalt gang",
-          "GOLD KINGSWOOD"
+          "GOLD KINGSWOOD",
+          "Cobalt Spider"
         ]
       },
       "uuid": "01967480-c49b-4d4a-a7fa-aef0eaf535fe",