diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 24852b6d..2fd7c749 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3918,12 +3918,14 @@
         "refs": [
           "https://blog.checkpoint.com/2015/03/31/volatilecedar/",
           "https://blog.checkpoint.com/2015/06/09/new-data-volatile-cedar/",
-          "https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/"
+          "https://securelist.com/sinkholing-volatile-cedar-dga-infrastructure/69421/",
+          "https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"
         ],
         "synonyms": [
           "Reuse team",
           "Malware reusers",
-          "Dancing Salome"
+          "Dancing Salome",
+          "Lebanese Cedar"
         ]
       },
       "uuid": "cf421ce6-ddfe-419a-bc65-6a9fc953232a",