diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 8bcd4d4b..206845f0 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -8750,6 +8750,16 @@
           ".fairytail"
         ]
       }
+    },
+    {
+      "value": "Thanatos",
+      "description": "first ransomware seen to ask for payment to be made in Bitcoin Cash (BCH)",
+      "meta": {
+        "refs": [
+          "https://mobile.twitter.com/EclecticIQ/status/968478323889332226",
+          "https://www.eclecticiq.com/resources/thanatos--ransomware-first-ransomware-ask-payment-bitcoin-cash?type=intel-report"
+        ]
+      }
     }
   ],
   "source": "Various",