diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 947e162..ebeef11 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2557,9 +2557,6 @@
           "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf",
           "https://www.trendmicro.com/vinfo/vn/security/news/cyber-attacks/cyberespionage-group-turla-deploys-backdoor-ahead-of-g20-summit",
           "https://www.zdnet.com/article/this-hacking-gang-just-updated-the-malware-it-uses-against-uk-targets/",
-          "https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/",
-          "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf",
-          "https://www2.fireeye.com/rs/848-DID-242/images/rpt-witchcoven.pdf",
           "https://attack.mitre.org/groups/G0010/"
         ],
         "synonyms": [
@@ -6741,7 +6738,6 @@
           "https://musalbas.com/blog/2016/08/16/equation-group-firewall-operations-catalogue.html",
           "https://www.vice.com/en_us/article/53djj3/shadow-brokers-whine-that-nobody-is-buying-their-hacked-nsa-files",
           "https://www.scmagazineuk.com/second-shadow-brokers-dump-released/article/1476023",
-          "https://securelist.com/darkpulsar/88199/",
           "https://www.cyberscoop.com/nsa-shadow-brokers-leaks-iran-russia-optimusprime-stoicsurgeon/",
           "https://www.csoonline.com/article/3190055/new-nsa-leak-may-expose-its-bank-spying-windows-exploits.html",
           "https://threatpost.com/shadowbrokers-dump-more-equation-group-hacks-auction-file-password/124882/",