diff --git a/clusters/rat.json b/clusters/rat.json
index 4f3bbed7..c5948f4d 100644
--- a/clusters/rat.json
+++ b/clusters/rat.json
@@ -7,7 +7,7 @@
   ],
   "description": "remote administration tool or remote access tool (RAT), also called sometimes remote access trojan, is a piece of software or programming that allows a remote \"operator\" to control a system as if they have physical access to that system.",
   "uuid": "312f8714-45cb-11e7-b898-135207cdceb9",
-  "version": 5,
+  "version": 6,
   "values": [
     {
       "meta": {
@@ -2162,6 +2162,15 @@
           "https://researchcenter.paloaltonetworks.com/2017/11/unit42-uboatrat-navigates-east-asia/"
         ]
       }
+    },
+    {
+      "description": "The EFF/Lookout report describes CrossRat as a “newly discovered desktop surveillanceware tool…which is able to target Windows, OSX, and Linux.”",
+      "value": "CrossRat",
+      "meta": {
+        "refs": [
+          "https://digitasecurity.com/blog/2018/01/23/crossrat/"
+        ]
+      }
     }
   ]
 }