diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2534fbf..d36667c 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -346,7 +346,7 @@
           "Private sector"
         ],
         "cfr-type-of-incident": "Espionage",
-        "country": "KP",
+        "country": "KR",
         "refs": [
           "https://securelist.com/blog/research/71713/darkhotels-attacks-in-2015/",
           "https://blogs.technet.microsoft.com/mmpc/2016/06/09/reverse-engineering-dubnium-2",