diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 25e623b..99b0e6f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1709,13 +1709,12 @@
         "refs": [
           "https://en.wikipedia.org/wiki/Operation_Newscaster",
           "https://iranthreats.github.io/resources/macdownloader-macos-malware/",
-          "https://www.isightpartners.com/2014/05/newscaster-iranian-threat-inside-social-media/",
+          "https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.05.28.NewsCaster_An_Iranian_Threat_Within_Social_Networks/file-2581720763-pdf.pdf",
           "https://www.forbes.com/sites/thomasbrewster/2017/07/27/iran-hackers-oilrig-use-fake-personas-on-facebook-linkedin-for-cyberespionage/",
           "https://cryptome.org/2012/11/parastoo-hacks-iaea.htm",
           "https://securelist.com/files/2017/03/Report_Shamoon_StoneDrill_final.pdf",
           "https://securelist.com/blog/software/74503/freezer-paper-around-free-meat/",
           "https://www.verfassungsschutz.de/download/broschuere-2016-10-bfv-cyber-brief-2016-04.pdf",
-          "https://github.com/gasgas4/APT_CyberCriminal_Campagin/tree/master/2014/2014.05.28.NewsCaster_An_Iranian_Threat_Within_Social_Networks",
           "https://www.cfr.org/interactive/cyber-operations/newscaster"
         ],
         "synonyms": [