diff --git a/clusters/tools.json b/clusters/tools.json
index 93bcc9c..60a9f4b 100644
--- a/clusters/tools.json
+++ b/clusters/tools.json
@@ -1034,8 +1034,12 @@
           "W32/Seeav"
         ]
       }
+    },
+    {
+       "value": "Tartine",
+       "description": "Delphi RAT used by Sofacy."
     }
-  ],
+],
   "version": 2,
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",