diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index caeb116..002afdd 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5760,7 +5760,8 @@
         "cfr-type-of-incident": "Espionage",
         "cfr-target-category": [
           "Private sector"
-        ]
+        ],
+        "country": "RU"
       },
       "uuid": "75ae52b2-bca3-11e8-af90-a78f33eee6c1"
     },
@@ -5796,7 +5797,8 @@
         "cfr-target-category": [
           "Government",
           "Private sector"
-        ]
+        ],
+        "country": "RU"
       },
       "uuid": "358b8982-bcaa-11e8-8a5b-4b618197c5b0",
       "related": [
@@ -5827,7 +5829,8 @@
         "cfr-type-of-incident": "Espionage",
         "cfr-target-category": [
           "Government"
-        ]
+        ],
+        "country": "RU"
       },
       "uuid": "1572f618-bcb3-11e8-841b-1fd7f9cfe126",
       "related": [
@@ -5858,7 +5861,8 @@
         "cfr-target-category": [
           "Civil society",
           "Government"
-        ]
+        ],
+        "country": "CN"
       },
       "uuid": "bea5e256-bcc0-11e8-a478-bbf7e7585a1e"
     },