diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index a0065909..32f1daca 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1600,7 +1600,8 @@
           "https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks",
           "https://blog.cyber4sight.com/2017/04/similarities-between-carbanak-and-fin7-malware-suggest-actors-are-closely-related/",
           "https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor",
-          "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns"
+          "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns",
+          "https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/"
         ],
         "motive": "Cybercrime"
       },
@@ -3763,5 +3764,5 @@
   ],
   "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.",
   "uuid": "7cdff317-a673-4474-84ec-4f1754947823",
-  "version": 46
+  "version": 47
 }