diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5cbfc37..26922b1 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -6285,7 +6285,8 @@
           "https://attack.mitre.org/groups/G0069/",
           "http://www.secureworks.com/research/threat-profiles/cobalt-ulster",
           "https://unit42.paloaltonetworks.com/atoms/boggyserpens/",
-          "https://www.sentinelone.com/blog/the-new-frontline-of-geopolitics-understanding-the-rise-of-state-sponsored-cyber-attacks/"
+          "https://www.sentinelone.com/blog/the-new-frontline-of-geopolitics-understanding-the-rise-of-state-sponsored-cyber-attacks/",
+          "https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
         ],
         "synonyms": [
           "TEMP.Zagros",
@@ -6297,7 +6298,8 @@
           "ATK51",
           "Boggy Serpens",
           "Mango Sandstorm",
-          "TA450"
+          "TA450",
+          "Earth Vetala"
         ]
       },
       "related": [