diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index ab881e1..9900145 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2916,7 +2916,8 @@
           "https://threatintel.blog/OPBlueRaven-Part2/",
           "https://www.secureworks.com/research/threat-profiles/gold-niagara",
           "https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous",
-          "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape"
+          "https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape",
+          "https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/"
         ],
         "synonyms": [
           "CARBON SPIDER",
@@ -2926,7 +2927,10 @@
           "G0046",
           "G0008",
           "Coreid",
-          "Carbanak"
+          "Carbanak",
+          "Sangria Tempest",
+          "ELBRUS",
+          "Carbon Spider"
         ]
       },
       "related": [