diff --git a/clusters/rat.json b/clusters/rat.json
index fa65c31..a9bbcc7 100644
--- a/clusters/rat.json
+++ b/clusters/rat.json
@@ -1764,8 +1764,12 @@
     },
     {
       "value": "Felismus RAT",
+      "description": "Used by Sowbug",
       "meta": {
-        "date": "2014"
+        "date": "2014",
+        "refs": [
+          "https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"
+        ]
       }
     },
     {