diff --git a/clusters/tool.json b/clusters/tool.json
index 0636248..ded4480 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -207,7 +207,12 @@
       "value": "Agent.dne"
     },
     {
-      "value": "Wipbot"
+      "value": "Wipbot",
+      "description": "Waterbug is the name given to the actors who use the malware tools Trojan.Wipbot (also known as Tavdig and Epic Turla)",
+      "meta": {
+        "synonyms": ["Tavdig", "Epic Turla"],
+        "refs": ["https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"]
+      }
     },
     {
       "value": "Turla"
@@ -1256,7 +1261,7 @@
        }
     }
   ],
-  "version": 15,
+  "version": 16,
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "author": [