diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 25a788ff..b5400a77 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -8544,6 +8544,9 @@
         ],
         "synonyms": [
           "Syn Ack"
+        ],
+        "ransomnotes": [
+          "RESTORE_INFO-[id].txt"
         ]
       }
     }