diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4a31f36..efbb4f1 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12125,13 +12125,18 @@
       "meta": {
         "refs": [
           "https://www.cybersecurity-insiders.com/scattered-spider-managed-mgm-resort-network-outage-brings-8m-loss-daily/",
-          "https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/"
+          "https://www.loginradius.com/blog/identity/oktapus-phishing-targets-okta-identity-credentials/",
+          "https://www.attackiq.com/2023/11/21/attack-graph-response-to-cisa-advisory-aa23-320a/",
+          "https://www.mandiant.com/resources/blog/unc3944-sms-phishing-sim-swapping-ransomware"
         ],
         "synonyms": [
           "UNC3944",
           "Muddled Libra",
           "Oktapus",
-          "Scattered Swine"
+          "Scattered Swine",
+          "Scatter Swine",
+          "Octo Tempest",
+          "0ktapus"
         ]
       },
       "uuid": "3b238f3a-c67a-4a9e-b474-dc3897e00129",