diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index a4b63eb9..6145b2da 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4220,7 +4220,14 @@
           "https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game",
           "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021",
           "https://go.recordedfuture.com/hubfs/reports/cta-2019-1212.pdf",
-          "https://unit42.paloaltonetworks.com/atoms/tridentursa"
+          "https://unit42.paloaltonetworks.com/atoms/tridentursa",
+          "https://cert.gov.ua/article/1229152",
+          "https://cert.gov.ua/article/971405",
+          "https://cert.gov.ua/article/40240",
+          "https://cert.gov.ua/article/39386",
+          "https://cert.gov.ua/article/39086",
+          "https://cert.gov.ua/article/39138",
+          "https://cert.gov.ua/article/18365"
         ],
         "synonyms": [
           "ACTINIUM",