diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b73b84b..c929748 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -9781,7 +9781,8 @@
         ],
         "country": "CN",
         "refs": [
-          "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"
+          "https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/",
+          "https://khonggianmang.vn/uploads/CB_941_Canhbao_APT_36c5a857fa.pdf"
         ],
         "synonyms": [
           "UNC94"