diff --git a/clusters/tool.json b/clusters/tool.json
index 950ef71..240822a 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -5744,7 +5744,17 @@
         ]
       },
       "uuid": "641464a6-b690-11e8-976e-bffc9a17c6a4"
+    },
+    {
+      "value": "Xbash",
+      "description": "Xbash is a malware family that is targeting Linux and Microsoft Windows servers. We can tie this malware, which we have named Xbash, to the Iron Group, a threat actor group known for previous ransomware attacks.",
+      "meta": {
+        "refs": [
+          "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
+        ]
+      },
+      "uuid": "10c981cc-4ef1-4719-8ed7-c5e4c2f6c7a3"
     }
   ],
-  "version": 87
+  "version": 88
 }