diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 873add9..7a0128c 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -29377,7 +29377,20 @@
       },
       "uuid": "ed692e27-c3ab-5ed8-ae4a-e436c4c5b454",
       "value": "pyrx"
+    },
+    {
+      "meta": {
+        "links": [
+          "http://6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion",
+          "http://6xdpj3sb5kekvq5ulym5qqmzsv6ektjgvpmajns3qrafgxtyxrhokfqd.onion/assets/index-6d8af759.js"
+        ],
+        "refs": [
+          "https://www.ransomlook.io/group/vanir group"
+        ]
+      },
+      "uuid": "2b7f6554-ac22-5b6c-85a0-65f55401c20e",
+      "value": "vanir group"
     }
   ],
-  "version": 127
+  "version": 128
 }