diff --git a/clusters/botnet.json b/clusters/botnet.json
index cc85c70..f8c02f8 100644
--- a/clusters/botnet.json
+++ b/clusters/botnet.json
@@ -1181,7 +1181,23 @@
       },
       "uuid": "ea2906a5-d493-4afa-b770-436c0c246c78",
       "value": "Mozi"
+    },
+    {
+      "description": "UPAS-Kit was advertised by auroras a/k/a vinny in middle of june 2012 via exploit.in. Upas is the predecessor of Kronos. Marcus Hutchins helped create and, in partnership with another, sell malicious computer code, a/k/a malware, known as UPAS-Kit.",
+      "meta": {
+        "refs": [
+          "https://research.checkpoint.com/2018/deep-dive-upas-kit-vs-kronos/",
+          "https://malware.dontneedcoffee.com/2012/08/inside-upas-kit1.0.1.1.html",
+          "https://web.archive.org/web/20130120062602/http://onthar.in/articles/upas-kit-analysis/",
+          "https://regmedia.co.uk/2019/04/19/plea.pdf"
+        ],
+        "synonyms": [
+          "Rombrast"
+        ]
+      },
+      "uuid": "099223a1-4a6e-4024-8e48-dbe199ec7244",
+      "value": "UPAS-Kit"
     }
   ],
-  "version": 22
+  "version": 23
 }