diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index f48e3e6..44f65db 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -481,6 +481,11 @@
     {
       "value": "Mad Max",
       "refs": ["https://www.arbornetworks.com/blog/asert/mad-max-dga/"]
+    },
+    {
+      "value": "Crimson",
+      "description": "Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims",
+      "refs: ["https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"]
     }
 
   ],