diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index b05c927..44894ee 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -16209,6 +16209,16 @@
       },
       "uuid": "b7f37e61-0e1c-4818-9a04-8f83afdd337c",
       "value": "Adrastea"
+    },
+    {
+      "description": "JuiceLedger is a threat actor known for infostealing through their JuiceStealer .NET assembly. They have evolved from spreading fraudulent applications to conducting supply chain attacks, targeting PyPI contributors with phishing campaigns and typosquatting. Their malicious packages contain a code snippet that downloads and executes JuiceStealer, which has evolved to support additional browsers and Discord. Victims of JuiceLedger attacks are advised to reset passwords and report any suspicious activity to security@pypi.org.",
+      "meta": {
+        "refs": [
+          "https://www.sentinelone.com/labs/pypi-phishing-campaign-juiceledger-threat-actor-pivots-from-fake-apps-to-supply-chain-attacks/"
+        ]
+      },
+      "uuid": "8f4eb6bc-3d3d-49e4-82d8-500c7bb0a2ec",
+      "value": "JuiceLedger"
     }
   ],
   "version": 312