diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4f5d076..b75494f 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -10464,13 +10464,16 @@
           "Ukraine"
         ],
         "cfr-type-of-incident": "Sabotage",
+        "country": "RU",
         "refs": [
           "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/",
           "https://msrc-blog.microsoft.com/2022/02/28/analysis-resources-cyber-threat-activity-ukraine/",
-          "https://unit42.paloaltonetworks.com/atoms/ruinousursa/"
+          "https://unit42.paloaltonetworks.com/atoms/ruinousursa/",
+          "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"
         ],
         "synonyms": [
-          "Ruinous Ursa"
+          "Ruinous Ursa",
+          "Cadet Blizzard"
         ]
       },
       "related": [