diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index f6219e5..ddbc741 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -3913,7 +3913,8 @@
           "APT-C-00",
           "SeaLotus",
           "APT-32",
-          "APT 32"
+          "APT 32",
+          "Ocean Buffalo"
         ]
       },
       "related": [