diff --git a/clusters/threat-actors.json b/clusters/threat-actors.json
index 98abb64..1112bb7 100644
--- a/clusters/threat-actors.json
+++ b/clusters/threat-actors.json
@@ -534,6 +534,23 @@
       ],
       "country": "IR"
     },
+    {
+      "value": "Rocket Kitten",
+      "description": "Targets Saudi Arabia, Israel, US, Iran, high ranking defense officials, embassies of various target countries, notable Iran researchers, human rights activists, media and journalists, academic institutions and various scholars, including scientists in the fields of physics and nuclear sciences.",
+      "refs": [
+        "https://www.trendmicro.com/vinfo/us/security/news/cyber-attacks/operation-woolen-goldfish-when-kittens-go-phishing",
+        "https://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-the-spy-kittens-are-back.pdf",
+        "http://www.clearskysec.com/thamar-reservoir/",
+        "https://citizenlab.org/2015/08/iran_two_factor_phishing/",
+        "https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"
+      ],
+      "country": "IR",
+      "synonyms": [
+        "TEMP.Beanie",
+        "Operation Woolen Goldfish",
+        "Thamar Reservoir"
+      ]
+    },
     {
       "value": "Cleaver",
       "refs": [