diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 610e7fe6..9874e993 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4483,7 +4483,9 @@
           "https://www.accenture.com/us-en/blogs/blogs-pond-loach-delivers-badcake-malware",
           "https://www.secureworks.com/research/threat-profiles/tin-woodlawn",
           "https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/",
-          "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"
+          "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html",
+          "https://www.microsoft.com/security/blog/2020/11/30/threat-actor-leverages-coin-miner-techniques-to-stay-under-the-radar-heres-how-to-spot-them",
+          "https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam"
         ],
         "synonyms": [
           "OceanLotus Group",
@@ -4497,7 +4499,8 @@
           "APT 32",
           "Ocean Buffalo",
           "POND LOACH",
-          "TIN WOODLAWN"
+          "TIN WOODLAWN",
+          "BISMUTH"
         ]
       },
       "related": [