diff --git a/clusters/ransomware.json b/clusters/ransomware.json
index 856dc880..cd6158b2 100644
--- a/clusters/ransomware.json
+++ b/clusters/ransomware.json
@@ -10704,7 +10704,11 @@
         "refs": [
           "https://www.spamfighter.com/News-21588-Aurora-Ransomware-Circulating-the-Cyber-Space.htm",
           "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-june-8th-2018-crybrazil-cryptconsole-and-magniber/",
-          "https://twitter.com/demonslay335/status/1004435398687379456"
+          "https://twitter.com/demonslay335/status/1004435398687379456",
+          "https://www.bleepingcomputer.com/news/security/aurora-zorro-ransomware-actively-being-distributed/"
+        ],
+        "synonyms": [
+          "Zorro Ransomware"
         ]
       },
       "uuid": "3ee0664e-706d-11e8-800d-9f690298b437",
@@ -11353,5 +11357,5 @@
       "value": "PyCL Ransomware"
     }
   ],
-  "version": 43
+  "version": 44
 }