diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5e7bf3e0..f167c72f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -12756,6 +12756,16 @@
       },
       "uuid": "1db6375f-0471-47c5-8128-5ab1519b01ab",
       "value": "Kiss-a-Dog"
+    },
+    {
+      "description": "Microsoft reported on MCCrash, an IoT botnet operated by the DEV-1028 threat actor and used to launch DDoS attacks against private Minecraft servers.",
+      "meta": {
+        "refs": [
+          "https://www.microsoft.com/en-us/security/blog/2022/12/15/mccrash-cross-platform-ddos-botnet-targets-private-minecraft-servers/"
+        ]
+      },
+      "uuid": "6616d2ac-2025-47f8-bb1a-1ece2b627c16",
+      "value": "DEV-1028"
     }
   ],
   "version": 293