diff --git a/clusters/tool.json b/clusters/tool.json
index 3272a20..6c44d9c 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -1073,9 +1073,14 @@
     },
     {
         "value": "Incognito RAT"
+    },
+    {
+        "value": "DownRage",
+        "synonyms": ["Carberplike"],
+        "refs": ["https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/", "https://twitter.com/Timo_Steffens/status/814781584536719360"]
     }
 ],
-  "version": 6,
+  "version": 7,
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "author": [