diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index bf67d65..c39e63c 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -24535,7 +24535,27 @@
       },
       "uuid": "bb6d933f-7b6d-4694-853d-1ca400f6bd8f",
       "value": "Rook"
+    },
+    {
+      "description": "HelloXD is a ransomware family performing double extortion attacks that surfaced in November 2021. During our research we observed multiple variants impacting Windows and Linux systems. Unlike other ransomware groups, this ransomware family doesn’t have an active leak site; instead it prefers to direct the impacted victim to negotiations through TOX chat and onion-based messenger instances.",
+      "meta": {
+        "date": "Nov. 30, 2021",
+        "extensions": [
+          "hello"
+        ],
+        "ransomnotes-filenames": [
+          "Hello.txt"
+        ],
+        "ransomnotes-refs": [
+          "https://unit42.paloaltonetworks.com/wp-content/uploads/2022/06/image13.png"
+        ],
+        "refs": [
+          "https://unit42.paloaltonetworks.com/helloxd-ransomware/"
+        ]
+      },
+      "uuid": "5617e6fa-4e6a-4011-9385-6b1165786563",
+      "value": "HelloXD"
     }
   ],
-  "version": 102
+  "version": 103
 }