diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index d9d8c962..05f9ddb3 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2185,7 +2185,8 @@
           "T-APT-12",
           "APT-C-20",
           "UAC-0028",
-          "FROZENLAKE"
+          "FROZENLAKE",
+          "Sofacy"
         ]
       },
       "related": [