diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json
index 8934153..2958d02 100644
--- a/clusters/threat-actor.json
+++ b/clusters/threat-actor.json
@@ -5901,7 +5901,21 @@
         ]
       },
       "uuid": "dda1b28e-c558-11e8-8666-27cf61d1d7ee"
+    },
+    {
+      "value": "FASTCash",
+      "description": "Treasury has identified a sophisticated cyber-enabled ATM cash out campaign we are calling FASTCash. FASTCash has been active since late 2016 targeting banks in Africa and Asia to remotely compromise payment switch application servers within banks to facilitate fraudulent transactions, primarily involving ATMs, to steal cash equivalent to tens of millions of dollars. FBI has attributed malware used in this campaign to the North Korean government. We expect FASTCash to continue targeting retail payment systems vulnerable to remote exploitation.",
+      "uuid": "e38d32a2-c708-11e8-8785-472c4cfccd85",
+      "related": [
+        {
+          "dest-uuid": "e306fe62-c708-11e8-89f2-073e396e5403",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ]
     }
   ],
-  "version": 67
+  "version": 68
 }
diff --git a/clusters/tool.json b/clusters/tool.json
index f0991b9..90386e7 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -5839,7 +5839,21 @@
         ]
       },
       "uuid": "55d29d1c-c550-11e8-9904-47c1d86af7c5"
+    },
+    {
+      "value": "FASTCash",
+      "description": "Treasury has identified a sophisticated cyber-enabled ATM cash out campaign we are calling FASTCash. FASTCash has been active since late 2016 targeting banks in Africa and Asia to remotely compromise payment switch application servers within banks to facilitate fraudulent transactions, primarily involving ATMs, to steal cash equivalent to tens of millions of dollars. FBI has attributed malware used in this campaign to the North Korean government. We expect FASTCash to continue targeting retail payment systems vulnerable to remote exploitation.",
+      "uuid": "e306fe62-c708-11e8-89f2-073e396e5403",
+      "related": [
+        {
+          "dest-uuid": "e38d32a2-c708-11e8-8785-472c4cfccd85",
+          "tags": [
+            "estimative-language:likelihood-probability=\"likely\""
+          ],
+          "type": "similar"
+        }
+      ]
     }
   ],
-  "version": 89
+  "version": 90
 }