diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 471169f..d503658 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1603,7 +1603,8 @@
         "attribution-confidence": "50",
         "country": "CN",
         "refs": [
-          "http://researchcenter.paloaltonetworks.com/2014/09/recent-watering-hole-attacks-attributed-apt-group-th3bug-using-poison-ivy/"
+          "http://researchcenter.paloaltonetworks.com/2014/09/recent-watering-hole-attacks-attributed-apt-group-th3bug-using-poison-ivy/",
+          "https://www.fox-it.com/nl/actueel/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/"
         ],
         "synonyms": [
           "APT20",