diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 02aecca..942ea3b 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12085,10 +12085,10 @@
     {
       "description": "Scarred Manticore has been pursuing high-value targets for years, utilizing a variety of IIS-based backdoors to attack Windows servers. These include a variety of custom web shells, custom DLL backdoors, and driver-based implants.",
       "meta": {
+        "country": "IR",
         "refs": [
           "https://research.checkpoint.com/2023/from-albania-to-the-middle-east-the-scarred-manticore-is-listening/"
-        ],
-        "country": "IR"
+        ]
       },
       "uuid": "79d0da59-9400-40f6-b72b-6c6f47354d59",
       "value": "Scarred Manticore"