diff --git a/clusters/android.json b/clusters/android.json
index 67e7b048..b554a733 100644
--- a/clusters/android.json
+++ b/clusters/android.json
@@ -4635,6 +4635,9 @@
       "meta": {
         "refs": [
           "https://blog.trendmicro.com/trendlabs-security-intelligence/adware-disguised-as-game-tv-remote-control-apps-infect-9-million-google-play-users/"
+        ],
+        "synonyms": [
+          "AndroidOS_HiddenAd"
         ]
       },
       "uuid": "64ee0ae8-2e78-43bf-b81b-e7e5c2e30cd0",
diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index ecda36b5..573697f8 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -5700,7 +5700,9 @@
           "https://www.bleepingcomputer.com/news/security/system-cryptomix-ransomware-variant-released/",
           "https://www.bleepingcomputer.com/news/security/mole66-cryptomix-ransomware-variant-released/",
           "https://www.bleepingcomputer.com/news/security/new-backup-cryptomix-ransomware-variant-actively-infecting-users/",
-          "https://twitter.com/demonslay335/status/1072227523755470848"
+          "https://twitter.com/demonslay335/status/1072227523755470848",
+          "https://www.coveware.com/blog/cryptomix-ransomware-exploits-cancer-crowdfunding",
+          "https://www.bleepingcomputer.com/news/security/cryptomix-ransomware-exploits-sick-children-to-coerce-payments/"
         ],
         "synonyms": [
           "Zeta"
@@ -11699,5 +11701,5 @@
       "value": "Djvu"
     }
   ],
-  "version": 47
+  "version": 48
 }