diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 27a3e18..c87410c 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -375,10 +375,13 @@
         "refs": [
           "https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/",
           "https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2",
-          "https://securelist.com/blog/research/66779/the-darkhotel-apt/",
+          "https://securelist.com/blog/research/66779/the-darkhotel-apt/",,
+          "https://securelist.com/the-darkhotel-apt/66779/"
           "http://drops.wooyun.org/tips/11726",
           "https://labs.bitdefender.com/wp-content/uploads/downloads/inexsmar-an-unusual-darkhotel-campaign/",
-          "https://www.cfr.org/interactive/cyber-operations/darkhotel"
+          "https://www.cfr.org/interactive/cyber-operations/darkhotel",
+          "https://www.securityweek.com/darkhotel-apt-uses-new-methods-target-politicians",
+          "https://attack.mitre.org/groups/G0012/>"
         ],
         "synonyms": [
           "DUBNIUM",
@@ -386,9 +389,12 @@
           "Karba",
           "Luder",
           "Nemim",
+          "Nemin"
           "Tapaoux",
           "Pioneer",
-          "Shadow Crane"
+          "Shadow Crane",
+          "APT-C-06",
+          "SIG25"
         ]
       },
       "related": [