diff --git a/clusters/malpedia.json b/clusters/malpedia.json
index 3cfe156..6c50ff2 100644
--- a/clusters/malpedia.json
+++ b/clusters/malpedia.json
@@ -7315,8 +7315,7 @@
           "https://killingthebear.jorgetesta.tech/actors/evil-corp",
           "https://experience.mandiant.com/trending-evil/p/1",
           "https://www.lac.co.jp/lacwatch/report/20220407_002923.html",
-          "https://thehackernews.com/2022/07/microsoft-links-raspberry-robin-usb.html?_m=3n%2e009a%2e2800%2ejp0ao0cjb8%2e1shm",
-          "https://redcanary.com/threat-detection-report/threats/socgholish/"
+          "https://thehackernews.com/2022/07/microsoft-links-raspberry-robin-usb.html?_m=3n%2e009a%2e2800%2ejp0ao0cjb8%2e1shm"
         ],
         "synonyms": [
           "FakeUpdate",
diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 54dfbb7..ec2f959 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9896,5 +9896,5 @@
       "value": "GOLD PRELUDE"
     }
   ],
-  "version": 251
+  "version": 252
 }
diff --git a/clusters/tool.json b/clusters/tool.json
index bdf8e23..7678317 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -8663,7 +8663,8 @@
         "refs": [
           "https://www.malwarebytes.com/blog/news/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms",
           "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/",
-          "https://www.secureworks.com/research/threat-profiles/gold-prelude"
+          "https://www.secureworks.com/research/threat-profiles/gold-prelude",
+          "https://redcanary.com/threat-detection-report/threats/socgholish/"
         ],
         "synonyms": [
           "FakeUpdate",