diff --git a/clusters/rat.json b/clusters/rat.json
index 5e30a3a..408797d 100644
--- a/clusters/rat.json
+++ b/clusters/rat.json
@@ -2111,7 +2111,8 @@
       "value": "NewCore",
       "meta": {
         "refs": [
-          "https://www.cyber.nj.gov/threat-profiles/trojan-variants/newcore"
+          "https://www.cyber.nj.gov/threat-profiles/trojan-variants/newcore",
+          "https://blog.fortinet.com/2017/09/05/rehashed-rat-used-in-apt-campaign-against-vietnamese-organizations"
         ],
         "date": "2017"
       }