diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index bc9fb22f..513e92f1 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -20,6 +20,11 @@
     {
       "value": "Torn RAT"
     },
+    {
+      "value": "OzoneRAT",
+      "refs": ["https://blog.fortinet.com/2016/08/29/german-speakers-targeted-by-spam-leading-to-ozone-rat"],
+      "synonyms": ["Ozone RAT","ozonercp"]
+    },
     {
       "value": "ZeGhost"
     },