diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index c2fe0c4..4193d92 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -436,6 +436,14 @@
     {
       "value": "Ruckguv",
       "refs": ["https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear"]
+    },
+    {
+      "value": "HerHer Trojan",
+      "refs": ["http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"]
+    },
+    {
+      "value": "Helminth backdoor",
+      "refs": ["http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"],
     }
   ],
   "version" : 1,