diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index 357f11c..f48e3e6 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -477,6 +477,10 @@
     {
       "value": "DownRange",
       "refs": ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
+    },
+    {
+      "value": "Mad Max",
+      "refs": ["https://www.arbornetworks.com/blog/asert/mad-max-dga/"]
     }
 
   ],