diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index e38fee06..2ad84fe2 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -673,6 +673,7 @@
         "synonyms": [
           "Winnti Umbrella",
           "Winnti Group",
+          "WinNTI",
           "Tailgater Team",
           "Suckfly",
           "APT41",
@@ -2396,7 +2397,8 @@
           "https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/",
           "https://www.washingtonpost.com/technology/2019/02/20/microsoft-says-it-has-found-another-russian-operation-targeting-prominent-think-tanks/?utm_term=.870ff11468ae",
           "https://www.handelsblatt.com/today/politics/election-risks-russia-linked-hackers-target-german-political-foundations/23569188.html?ticket=ST-2696734-GRHgtQukDIEXeSOwksXO-ap1",
-          "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf"
+          "https://www.accenture.com/t20190213T141124Z__w__/us-en/_acnmedia/PDF-94/Accenture-SNAKEMACKEREL-Threat-Campaign-Likely-Targeting-NATO-Members-Defense-and-Military-Outlets.pdf",
+          "https://marcoramilli.com/2019/12/05/apt28-attacks-evolution/"
         ],
         "synonyms": [
           "APT 28",
@@ -7826,5 +7828,5 @@
       "value": "APT-C-34"
     }
   ],
-  "version": 145
+  "version": 146
 }