diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index dc2a67b..7e15b54 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -8450,18 +8450,24 @@
     {
       "description": "Ghostwriter is referred as an 'activity set', with various incidents tied together by overlapping behavioral characteristics and personas, rather than as an actor or group in itself.",
       "meta": {
+        "attribution-confidence": "50",
+        "cfr-suspected-state-sponsor": "Belarus",
         "cfr-suspected-victims": [
           "Germany",
           "Latvia",
           "Lithuania",
-          "Poland"
+          "Poland",
+          "Ukraine"
         ],
         "cfr-target-category": [
           "Government"
         ],
+        "country": "BY",
         "refs": [
           "https://www.fireeye.com/blog/threat-research/2020/07/ghostwriter-influence-campaign.html",
-          "https://twitter.com/hatr/status/1377220336597483520"
+          "https://twitter.com/hatr/status/1377220336597483520",
+          "https://www.mandiant.com/resources/unc1151-linked-to-belarus-government",
+          "https://www.bleepingcomputer.com/news/security/meta-ukrainian-officials-military-targeted-by-ghostwriter-hackers/"
         ]
       },
       "uuid": "749aaa11-f0fd-416b-bf6c-112f9b5930a5",