diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2a8f947c..d7a71f84 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2243,7 +2243,8 @@
           "https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/",
           "https://www.secureworks.com/research/threat-profiles/iron-hemlock",
           "https://attack.mitre.org/groups/G0016",
-          "https://unit42.paloaltonetworks.com/atoms/cloaked-ursa/"
+          "https://unit42.paloaltonetworks.com/atoms/cloaked-ursa/",
+          "https://go.recordedfuture.com/hubfs/reports/cta-2023-0127.pdf"
         ],
         "synonyms": [
           "Group 100",
@@ -2259,7 +2260,8 @@
           "Cloaked Ursa",
           "TA421",
           "Blue Kitsune",
-          "ITG11"
+          "ITG11",
+          "BlueBravo"
         ]
       },
       "related": [