diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5686de69..471169f4 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2425,7 +2425,8 @@
           "IRON TWILIGHT",
           "Group 74",
           "SIG40",
-          "Grizzly Steppe"
+          "Grizzly Steppe",
+          "apt_sofacy"
         ]
       },
       "related": [