diff --git a/clusters/threat-actors.json b/clusters/threat-actors.json
index 3eaf47d..f01403f 100644
--- a/clusters/threat-actors.json
+++ b/clusters/threat-actors.json
@@ -905,6 +905,10 @@
        "value": "TeamXRat",
        "refs": ["https://securelist.com/blog/research/76153/teamxrat-brazilian-cybercrime-meets-ransomware/"],
        "synonyms": ["CorporacaoXRat","CorporationXRat"]
+     },
+     {
+       "value": "OilRig",
+       "refs": ["http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"]
      }
   ]
 }