diff --git a/clusters/tool.json b/clusters/tool.json
index 5cea33b..f5dc606 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -10,7 +10,7 @@
   ],
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
-  "version": 55,
+  "version": 56,
   "values": [
     {
       "meta": {
@@ -1138,6 +1138,9 @@
           "Hoarde",
           "Phindolp",
           "BS2005"
+        ],
+        "refs":[
+          "https://github.com/nccgroup/Royal_APT"
         ]
       },
       "value": "Hoardy",