diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index efa585cd..1b6498a8 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10033,6 +10033,7 @@
         ],
         "country": "CN",
         "refs": [
+	  "https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf",
           "https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf"
         ]
       },