diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 6a2f245..9d99e81 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -1601,6 +1601,19 @@
           "https://www.cylance.com/en_us/blog/el-machete-malware-attacks-cut-through-latam.html"
         ]
       }
+    },
+    {
+      "value": "Cobalt",
+      "description": "A criminal group dubbed Cobalt is behind synchronized ATM heists that saw machines across Europe, CIS countries (including Russia), and Malaysia being raided simultaneously, in the span of a few hours. The group has been active since June 2016, and their latest attacks happened in July and August.",
+      "meta": {
+        "refs": [
+          "https://www.helpnetsecurity.com/2016/11/22/cobalt-hackers-synchronized-atm-heists/"
+        ],
+        "synonyms": [
+          "Cobalt group",
+          "Cobalt gang"
+        ]
+      }
     }
   ],
   "name": "Threat actor",