diff --git a/elements/adversary-groups.json b/elements/adversary-groups.json
index cca888a..dc203a9 100644
--- a/elements/adversary-groups.json
+++ b/elements/adversary-groups.json
@@ -22,6 +22,16 @@
       "country": "CN",
       "group": "Stalker Panda"
     },
+    {
+      "country": "CN",
+      "group": "Codoso",
+      "refs": [
+        "https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks"
+      ],
+      "synonyms": [
+        "C0d0so"
+      ]
+    },
     {
       "country": "CN",
       "group": "Karma Panda",
@@ -722,7 +732,8 @@
     "SNOWGLOBE",
     "Sands Casino",
     "Cleaver",
-    "Threat Group-2889"
+    "Threat Group-2889",
+    "Codoso"
   ],
   "type": "Adversary Groups",
   "authors": [