diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8fb9360..2e9178d 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2798,7 +2798,9 @@
           "https://www.welivesecurity.com/2017/05/23/xdata-ransomware-making-rounds-amid-global-wannacryptor-scare",
           "https://www.welivesecurity.com/2017/06/27/new-ransomware-attack-hits-ukraine",
           "https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back",
-          "https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/"
+          "https://blog.google/threat-analysis-group/fog-of-war-how-the-ukraine-conflict-transformed-the-cyber-threat-landscape/",
+          "https://www.recordedfuture.com/russia-nexus-uac-0113-emulating-telecommunication-providers-in-ukraine",
+          "https://cert.gov.ua/article/405538"
         ],
         "synonyms": [
           "Quedagh",
@@ -2810,7 +2812,8 @@
           "TeleBots",
           "IRIDIUM",
           "Blue Echidna",
-          "FROZENBARENTS"
+          "FROZENBARENTS",
+          "UAC-0113"
         ],
         "targeted-sector": [
           "Electric",