diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index a587e46..acf1649 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -8506,8 +8506,8 @@
       "description": "RedEcho: The group made heavy use of AXIOMATICASYMPTOTE — a term we use to track infrastructure that comprises ShadowPad C2s, which is shared between several Chinese threat activity groups",
       "meta": {
         "refs": [
-        	"https://www.recordedfuture.com/redecho-targeting-indian-power-sector/",
-        	"https://therecord.media/redecho-group-parks-domains-after-public-exposure/"
+          "https://www.recordedfuture.com/redecho-targeting-indian-power-sector/",
+          "https://therecord.media/redecho-group-parks-domains-after-public-exposure/"
         ]
       },
       "uuid": "986fcc3f-5f36-4975-bf5f-c42524466bbd",
@@ -8515,4 +8515,4 @@
     }
   ],
   "version": 199
-}
\ No newline at end of file
+}