diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index b56ce53..e089c73 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -23579,7 +23579,21 @@
     {
       "description": "ransomware",
       "uuid": "201eff54-d41e-4f70-916c-5dfb9301730a",
-      "value": "Conti"
+      "value": "Conti",
+      "refs": [
+        "https://www.cyber.gov.au/acsc/view-all-content/advisories/2021-010-acsc-ransomware-profile-conti",
+        ""
+      ],
+      "meta": {
+        "attribution-confidence": "100",
+        "country": "RU",
+        "extensions": [
+          ".conti"
+        ],
+        "ransomnotes": [
+          "All of your files are currently encrypted by CONTI ransomware."
+        ]
+      }
     },
     {
       "description": "ransomware",