diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index a99b741..517daf9 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -372,7 +372,8 @@
           "TUNGSTEN BRIDGE",
           "T-APT-02",
           "G0012",
-          "ATK52"
+          "ATK52",
+          "Zigzag Hail"
         ]
       },
       "related": [