diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5178c5d..239a323 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -4197,7 +4197,8 @@
           "https://attack.mitre.org/groups/G0047/",
           "https://github.com/StrangerealIntel/CyberThreatIntel/tree/master/Russia/APT/Gamaredon",
           "https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf",
-          "https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/"
+          "https://www.welivesecurity.com/2020/06/18/digging-up-invisimole-hidden-arsenal/",
+          "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"
         ],
         "synonyms": [
           "Primitive Bear",