diff --git a/README.md b/README.md
index b7f4bcb9..3ca43ffd 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,7 @@ to localized information (which is not shared) or additional information (that c
 
 - [clusters/android.json](clusters/android.json) - Android malware galaxy based on multiple open sources.
 - [clusters/banker.json](clusters/banker.json) - A list of banker malware.
+- [clusters/botnet.json](clusters/botnet.json) - A list of known botnets.
 - [clusters/branded_vulnerability.json](clusters/branded_vulnerability.json) - List of known vulnerabilities and exploits.
 - [clusters/exploit-kit.json](clusters/exploit-kit.json) - Exploit-Kit is an enumeration of some exploitation kits used by adversaries. The list includes document, browser and router exploit kits. It's not meant to be totally exhaustive but aim at covering the most seen in the past 5 years.
 - [clusters/microsoft-activity-group.json](clusters/microsoft-activity-group.json) - Activity groups as described by Microsoft.