diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 5d1f1c75..9caddb06 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -7106,6 +7106,31 @@
           "ATK103",
           "Hive0065",
           "CHIMBORAZO"
+        ],
+        "cfr-target-category": [
+          "Education",
+          "Finance",
+          "Health",
+          "Retail",
+          "Hospitality"
+        ],
+        "cfr-suspected-victims": [
+          "Australia",
+          "Canada",
+          "Czech Republic",
+          "Germany",
+          "Hungary",
+          "India",
+          "Japan",
+          "Romania",
+          "Serbia",
+          "Singapore",
+          "South Korea",
+          "Spain",
+          "Thailand",
+          "Turkey",
+          "United Kingdom",
+          "United States"
         ]
       },
       "related": [