diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4a31f36..4ec3dc0 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -13639,6 +13639,18 @@
       },
       "uuid": "5e32baed-f4b5-4149-8540-7515ad8c4dc0",
       "value": "Daixin Team"
+    },
+    {
+      "description": "UNC2717 is a threat actor that engages in espionage activities aligned with Chinese government priorities. They demonstrate advanced tradecraft and take measures to avoid detection, making it challenging for network defenders to identify their tools and intrusion methods. UNC2717, along with other Chinese APT actors, has been observed stealing credentials, email communications, and intellectual property. They have targeted global government agencies using malware such as HARDPULSE, QUIETPULSE, and PULSEJUMP.",
+      "meta": {
+        "country": "CN",
+        "refs": [
+          "https://www.fireeye.com/blog/threat-research/2021/05/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices.html",
+          "http://internal-www.fireeye.com/blog/threat-research/2021/04/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day.html"
+        ]
+      },
+      "uuid": "f1d90b54-4821-41ff-8e07-ac650e0454b7",
+      "value": "UNC2717"
     }
   ],
   "version": 295