diff --git a/clusters/microsoft-activity-group.json b/clusters/microsoft-activity-group.json
index 921d61a..40605ab 100644
--- a/clusters/microsoft-activity-group.json
+++ b/clusters/microsoft-activity-group.json
@@ -343,6 +343,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -359,6 +360,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -373,6 +375,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -401,6 +404,7 @@
     },
     {
       "meta": {
+        "country": "VN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -444,6 +448,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -473,6 +478,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -486,6 +492,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -501,6 +508,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -516,6 +524,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -543,6 +552,7 @@
     },
     {
       "meta": {
+        "country": "KP",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -558,6 +568,7 @@
     },
     {
       "meta": {
+        "country": "KP",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -573,6 +584,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -588,6 +600,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -603,6 +616,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -620,6 +634,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -633,6 +648,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -646,6 +662,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -677,6 +694,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -693,6 +711,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -722,6 +741,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -739,6 +759,7 @@
     },
     {
       "meta": {
+        "country": "TR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -753,6 +774,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -767,6 +789,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -782,6 +805,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -797,6 +821,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -841,6 +866,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -857,6 +883,7 @@
     },
     {
       "meta": {
+        "country": "KP",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -871,6 +898,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -886,6 +914,7 @@
     },
     {
       "meta": {
+        "country": "KP",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -931,6 +960,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -963,6 +993,7 @@
     },
     {
       "meta": {
+        "country": "LB",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -976,6 +1007,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -990,6 +1022,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1005,6 +1038,7 @@
     },
     {
       "meta": {
+        "country": "KP",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1033,6 +1067,7 @@
     },
     {
       "meta": {
+        "country": "KP",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1048,6 +1083,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1062,6 +1098,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1078,6 +1115,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1091,6 +1129,7 @@
     },
     {
       "meta": {
+        "country": "IR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1118,6 +1157,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1147,6 +1187,7 @@
     },
     {
       "meta": {
+        "country": "KP",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1175,6 +1216,7 @@
     },
     {
       "meta": {
+        "country": "RU",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1228,6 +1270,7 @@
     },
     {
       "meta": {
+        "country": "CN",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1270,6 +1313,7 @@
     },
     {
       "meta": {
+        "country": "KR",
         "refs": [
           "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
         ],
@@ -1284,5 +1328,5 @@
       "value": "Zigzag Hail"
     }
   ],
-  "version": 14
+  "version": 16
 }