diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 07f542d..e25c223 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5991,6 +5991,9 @@
         "refs": [
           "http://securityaffairs.co/wordpress/68059/cyber-crime/eviltraffic-malvertising-campaign.html",
           "http://csecybsec.com/download/zlab/20180121_CSE_Massive_Malvertising_Report.pdf"
+        ],
+        "synonyms": [
+          "Operation EvilTraffic"
         ]
       },
       "uuid": "c2d5a052-dc30-11e8-9643-d76f3b9c94fa"