diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 540bf35..7ad6f8f 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -23586,11 +23586,11 @@
         ],
         "ransomnotes": [
           "All of your files are currently encrypted by CONTI ransomware."
+        ],
+        "refs": [
+          "https://www.cyber.gov.au/acsc/view-all-content/advisories/2021-010-acsc-ransomware-profile-conti"
         ]
       },
-      "refs": [
-        "https://www.cyber.gov.au/acsc/view-all-content/advisories/2021-010-acsc-ransomware-profile-conti"
-      ],
       "uuid": "201eff54-d41e-4f70-916c-5dfb9301730a",
       "value": "Conti"
     },