diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index 46f58d8..d6069a0 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -18,6 +18,12 @@
     {
       "value": "ZeGhost"
     },
+    {
+      "value": "Backdoor.Dripion",
+      "description": "Backdoor.Dripion was custom developed, deployed in a highly targeted fashion, and used command and control servers disguised as antivirus company websites.",
+      "refs": ["http://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan"],
+      "synonyms": ["Dripion"]
+    },
     {
       "value": "Elise Backdoor",
       "synonyms": ["Elise"]