diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 1207015..136f219 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5078,10 +5078,14 @@
         "refs": [
           "https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets",
           "https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html",
-          "https://www.cfr.org/interactive/cyber-operations/leviathan"
+          "https://www.cfr.org/interactive/cyber-operations/leviathan",
+          "https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"
         ],
         "synonyms": [
-          "TEMP.Periscope"
+          "TEMP.Periscope",
+          "TEMP.Jumper",
+          "APT 40",
+          "APT40"
         ]
       },
       "related": [