diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2cc1f6a6..2d5e637d 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10497,7 +10497,9 @@
           "https://unit42.paloaltonetworks.com/atoms/nascentursa/",
           "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/nodaria-ukraine-infostealer",
           "https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/",
-          "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
+          "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/",
+          "https://circleid.com/posts/20230412-probing-lorec53-phishing-through-the-dns-microscope",
+          "https://nsfocusglobal.com/wp-content/uploads/2021/11/Analysis-Report-on-Lorec53-Group.pdf"
         ],
         "synonyms": [
           "UNC2589",
@@ -10508,7 +10510,8 @@
           "FROZENVISTA",
           "Storm-0587",
           "DEV-0587",
-          "Saint Bear"
+          "Saint Bear",
+          "Lorec53"
         ]
       },
       "uuid": "c67d3dfb-ab39-46e1-a971-5efdfe6a5b9f",