diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 4764bb8..58425cb 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7764,8 +7764,6 @@
       "value": "Operation Soft Cell"
     },
     {
-      "value": "Operation WizardOpium",
-      "uuid": "75db4269-924b-4771-8f62-0de600a43634",
       "description": "We are calling these attacks Operation WizardOpium. So far, we have been unable to establish a definitive link with any known threat actors. There are certain very weak code similarities with Lazarus attacks, although these could very well be a false flag. The profile of the targeted website is more in line with earlier DarkHotel attacks that have recently deployed similar false flag attacks.",
       "meta": {
         "refs": [
@@ -7774,7 +7772,9 @@
         "threat-actor-classification": [
           "campaign"
         ]
-      }
+      },
+      "uuid": "75db4269-924b-4771-8f62-0de600a43634",
+      "value": "Operation WizardOpium"
     }
   ],
   "version": 138