diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 1e0f406..cdbeb69 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -734,8 +734,8 @@
         "cfr-target-category": [
           "Government"
         ],
-        "country": "CN",
         "cfr-type-of-incident": "Espionage",
+        "country": "CN",
         "refs": [
           "https://attack.mitre.org/wiki/Group/G0013",
           "https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf",