workaround for attrib_threat_actor