diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8d488d3..1e0f406 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -735,6 +735,7 @@
           "Government"
         ],
         "country": "CN",
+        "cfr-type-of-incident": "Espionage",
         "refs": [
           "https://attack.mitre.org/wiki/Group/G0013",
           "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf",