diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index 4c260ba..1dd0a74 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -204,6 +204,12 @@
       "description": "RAT initially written in VB.",
       "refs": ["https://www.sentinelone.com/blog/understanding-kjw0rm-malware-we-dive-in-to-the-tv5-cyber-attack/"]
     },
+    {
+      "value": "TinyTyphon"
+    },
+    {
+      "value": "Badnews"
+    },
     {
       "value": "LURK"
     },