diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index fb10ee49..f7856ac9 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -11489,7 +11489,13 @@
         "country": "",
         "references": [
           "https://www.crowdstrike.com/blog/prophet-spider-exploits-oracle-weblogic-to-facilitate-ransomware-activity/",
-          "https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/"
+          "https://www.crowdstrike.com/blog/prophet-spider-exploits-citrix-sharefile/",
+          "https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker",
+          "https://www.mandiant.com/resources/blog/unc961-multiverse-financially-motivated"
+        ],
+        "synonyms": [
+          "GOLD MELODY",
+          "UNC961"
         ]
       },
       "related": [