diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2430253..03f33ff 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12556,6 +12556,17 @@
       },
       "uuid": "7b227f41-efea-4dc0-8a2a-148893795ce4",
       "value": "DustSquad"
+    },
+    {
+      "description": "KromSec is a hacktivist group that claims to be composed of hackers, activists, writers, and journalists. The group has been involved in a number of high-profile cyberattacks, including a cyber offensive against Iran in September 2022 and the sale of the database of the Iran Ministry of Industries and Mines on a hacker forum in November 2023. KromSec's attacks have been met with mixed reactions, but the group has quickly made a name for itself as a significant threat to governments and organizations around the world.",
+      "meta": {
+        "refs": [
+          "https://thecyberexpress.com/kromsec-sells-iran-ministry-database-dark-web/",
+          "https://cybershafarat.com/2022/11/17/kromsec-outs-anonopsse-as-iranian-regime-makes-statement/"
+        ]
+      },
+      "uuid": "f4b81cb7-0492-414f-8bf4-cc806cbff1a9",
+      "value": "KromSec"
     }
   ],
   "version": 292