diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index c0848c2..d9013c7 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -6495,7 +6495,9 @@
           "_WHAT_is.html",
           "_INSTRUCTION.html",
           "DesktopOSIRIS.(bmp|htm)",
-          "OSIRIS-[0-9]{4}.htm"
+          "OSIRIS-[0-9]{4}.htm",
+          "lukitus.htm",
+          "lukitus.bmp."
         ],
         "refs": [
           "http://www.bleepingcomputer.com/news/security/new-locky-version-adds-the-zepto-extension-to-encrypted-files/",