diff --git a/clusters/botnet.json b/clusters/botnet.json
index 86c3724..a7862a8 100644
--- a/clusters/botnet.json
+++ b/clusters/botnet.json
@@ -2,7 +2,7 @@
   "description": "botnet galaxy",
   "uuid": "a91732f4-164a-11e8-924a-ffd4097eb03f",
   "source": "MISP Project",
-  "version": 7,
+  "version": 8,
   "values": [
     {
       "meta": {
@@ -513,6 +513,16 @@
       "value": "Mirai",
       "uuid": "fcdfd4af-da35-49a8-9610-19be8a487185"
     },
+    {
+      "value": "XorDDoS",
+      "uuid": "5485d149-79b5-451e-b48c-a020eced3515",
+      "description": "XOR DDOS is a Linux trojan used to perform large-scale DDoS",
+      "meta": {
+        "refs": [
+          "https://en.wikipedia.org/wiki/Xor_DDoS"
+        ]
+      }
+    },
     {
       "meta": {
         "refs": [