diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index f4d6886..3508411 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3324,12 +3324,14 @@
           "https://raw.githubusercontent.com/pan-unit42/playbook_viewer/master/playbook_json/oilrig.json",
           "https://www.cfr.org/interactive/cyber-operations/oilrig",
           "https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/",
-          "https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"
+          "https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/",
+          "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"
         ],
         "synonyms": [
           "Twisted Kitten",
           "Cobalt Gypsy",
-          "Crambus"
+          "Crambus",
+          "Helix Kitten"
         ]
       },
       "related": [