diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 68e64ca8..04127c1a 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -11585,10 +11585,12 @@
           "https://labs.k7computing.com/index.php/romcom-rat-not-your-typical-love-story/",
           "https://blogs.blackberry.com/en/2023/07/decoding-romcom-behaviors-and-opportunities-for-detection",
           "https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html",
-          "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html"
+          "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html",
+          "https://blog.talosintelligence.com/uat-5647-romcom/"
         ],
         "synonyms": [
-          "Storm-0978"
+          "Storm-0978",
+          "UAT-5647"
         ]
       },
       "uuid": "ba9e1ed2-e142-48d0-a593-f73ac6d59ccd",