diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 68e33ad..456867f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -8160,10 +8160,13 @@
       "meta": {
         "refs": [
           "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_the_taidoor_campaign.pdf",
-          "https://attack.mitre.org/groups/G0015/"
+          "https://attack.mitre.org/groups/G0015/",
+          "https://www.trendmicro.com/en_us/research/22/j/tracking-earth-aughiskys-malware-and-changes.html",
+          "https://blog.reversinglabs.com/blog/taidoor-a-truly-persistent-threat"
         ],
         "synonyms": [
-          "G0015"
+          "G0015",
+          "Earth Aughisky"
         ]
       },
       "uuid": "e6669606-91ad-11e9-b6f5-374843911989",