diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 2ad84fe..531a595 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -2418,7 +2418,8 @@
           "IRON TWILIGHT",
           "Group 74",
           "SIG40",
-          "Grizzly Steppe"
+          "Grizzly Steppe",
+          "apt_sofacy"
         ]
       },
       "related": [