diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2ee4e58..0a1cdbc 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3086,7 +3086,10 @@
           "https://www.welivesecurity.com/2020/11/16/lazarus-supply-chain-attack-south-korea/",
           "https://dragos.com/adversaries.html",
           "https://dragos.com/media/2017-Review-Industrial-Control-System-Threats.pdf",
-          "https://www.cfr.org/interactive/cyber-operations/covellite"
+          "https://www.cfr.org/interactive/cyber-operations/covellite",
+          "https://www.hvs-consulting.de/lazarus-report/",
+          "https://github.com/hvs-consulting/ioc_signatures/tree/main/Lazarus_APT37",
+          "https://blogs.jpcert.or.jp/en/2021/01/Lazarus_tools.html"
         ],
         "synonyms": [
           "Operation DarkSeoul",
@@ -8439,5 +8442,5 @@
       "value": "UNC2452"
     }
   ],
-  "version": 196
+  "version": 197
 }