diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index c802220..28608c2 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -859,6 +859,10 @@
     {
       "description": "GNL Locker; .zyklon; ",
       "value": "Zyklon"
+    },
+    {
+      "description": "AES; ",
+      "value": "Erebus"
     }
   ],
   "source": "https://docs.google.com/spreadsheets/d/1TWS238xacAto-fLKh1n5uTsdijWdCEsGIM0Y0Hvmc5g/pubhtml"