diff --git a/clusters/tool.json b/clusters/tool.json
index 6b156f90..06362480 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -1247,9 +1247,16 @@
          "refs": ["http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid/"],
          "country": "IT"
        }
+    },
+    {
+       "value": "LuminosityLink",
+       "description": "LuminosityLink is a malware family costing $40 that purports to be a system administration utility",
+       "meta": {
+         "refs": ["http://researchcenter.paloaltonetworks.com/2016/07/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/"]
+       }
     }
   ],
-  "version": 14,
+  "version": 15,
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "author": [