diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index c39e63c6..371526ca 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -24555,7 +24555,18 @@
       },
       "uuid": "5617e6fa-4e6a-4011-9385-6b1165786563",
       "value": "HelloXD"
+    },
+    {
+      "description": "Maui ransomware stand out because of a lack of several key features commonly seen with tooling from RaaS providers, such as an embedded ransom note to provide recovery instructions or automated means of transmitting encryption keys to attackers. Instead, it is believed that Maui is manually operated, in which operators will specify which files to encrypt when executing it and then exfiltrate the resulting runtime artifacts. There are many aspects to Maui ransomware that are unknown, including usage context.",
+      "meta": {
+        "refs": [
+          "https://stairwell.com/wp-content/uploads/2022/07/Stairwell-Threat-Report-Maui-Ransomware.pdf",
+          "https://www.cisa.gov/uscert/ncas/alerts/aa22-187a"
+        ]
+      },
+      "uuid": "995c3772-dbda-4a2a-9e28-c47740d599a3",
+      "value": "Maui ransomware"
     }
   ],
-  "version": 103
+  "version": 104
 }