diff --git a/clusters/tool.json b/clusters/tool.json
index b27989c3..3272a207 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -883,7 +883,8 @@
           "Unrecom",
           "Sockrat",
           "JSocket",
-          "jRat"
+          "jRat",
+          "Backdoor:Java/Adwind"
         ]
       }
     },
@@ -1069,9 +1070,12 @@
     },
     {
         "value": "Backdoor.Tinybaron"
+    },
+    {
+        "value": "Incognito RAT"
     }
 ],
-  "version": 5,
+  "version": 6,
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "author": [