diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4b1c439..42d990c 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3681,6 +3681,7 @@
         "cfr-type-of-incident": "Espionage",
         "country": "CN",
         "refs": [
+          "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/eagle-eye-is-back-apt30/",
           "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf",
           "https://attack.mitre.org/wiki/Group/G0013",
           "https://www.cfr.org/interactive/cyber-operations/apt-30"
@@ -8352,5 +8353,5 @@
       "value": "GALLIUM"
     }
   ],
-  "version": 165
+  "version": 166
 }