diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5624bdc..d8ad39e 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -6957,7 +6957,10 @@
           "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf",
           "https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf",
           "https://services.google.com/fh/files/blogs/google_fog_of_war_research_report.pdf",
-          "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"
+          "https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html",
+          "https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader",
+          "https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european",
+          "https://unit42.paloaltonetworks.com/stately-taurus-targets-philippines-government-cyberespionage/"
         ],
         "synonyms": [
           "BRONZE PRESIDENT",
@@ -6965,7 +6968,10 @@
           "Red Lich",
           "TEMP.HEX",
           "BASIN",
-          "Earth Preta"
+          "Earth Preta",
+          "TA416",
+          "Stately Taurus",
+          "LuminousMoth"
         ]
       },
       "uuid": "78bf726c-a9e6-11e8-9e43-77249a2f7339",