diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 18f527cc..ad9a2d29 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -8468,7 +8468,7 @@
       "meta": {
         "refs": [
           "https://twitter.com/anthomsec/status/1321865315513520128",
-          "https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html",
+          "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html",
           "https://gist.github.com/aaronst/6aa7f61246f53a8dd4befea86e832456",
           "https://www.youtube.com/watch?v=CgDtm05qApE",
           "https://www.fireeye.com/blog/threat-research/2020/03/the-cycle-of-adversary-pursuit.html"