diff --git a/clusters/tool.json b/clusters/tool.json
index f0d1983..4bab6de 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -1736,9 +1736,12 @@
       "value": "Tdrop2"
     },
     {
+      "description": "ZxShell is a remote access trojan (RAT). It was developed in 2006 by the persona \"LZX\", who then publicly released the source code in 2007",
       "meta": {
         "refs": [
-          "http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html"
+          "http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html",
+          "https://blogs.cisco.com/security/talos/opening-zxshell",
+          "https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox"
         ],
         "synonyms": [
           "Sensode"
@@ -8204,7 +8207,21 @@
       "related": [],
       "uuid": "5ce18513-bd12-4689-a705-634cf727162e",
       "value": "Beds Protector"
+    },
+    {
+      "description": "HyperBro Trojan was used as last-stage in-memory remote administration tool (RAT).",
+      "meta": {
+        "refs": [
+          "https://securelist.com/luckymouse-hits-national-data-center/86083/"
+        ],
+        "type": [
+          "RAT"
+        ]
+      },
+      "related": [],
+      "uuid": "e1bfe1d9-190c-4cf4-aec8-a8f2c41c7d8b",
+      "value": "HyperBro"
     }
   ],
-  "version": 139
+  "version": 140
 }