diff --git a/clusters/tool.json b/clusters/tool.json
index fc9f543..bc8281c 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -10,7 +10,7 @@
   ],
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
-  "version": 45,
+  "version": 46,
   "values": [
     {
       "meta": {
@@ -3246,6 +3246,15 @@
           "https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/"
         ]
       }
+    },
+    {
+      "value": "CoinMiner",
+      "description": "Monero-mining malware",
+      "meta": {
+        "refs": [
+          "https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/"
+        ]
+      }
     }
   ]
 }