diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 71dd290b..c0848c22 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -6482,7 +6482,8 @@
           "([A-F0-9]{32}).thor",
           "([A-F0-9]{32}).aesir",
           "([A-F0-9]{32}).zzzzz",
-          "([A-F0-9]{32}).osiris"
+          "([A-F0-9]{32}).osiris",
+          ".lukitus"
         ],
         "encryption": "AES-128",
         "ransomnotes": [