diff --git a/clusters/tool.json b/clusters/tool.json
index b7949df3..2ecdb674 100644
--- a/clusters/tool.json
+++ b/clusters/tool.json
@@ -10,7 +10,7 @@
   ],
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
   "uuid": "0d821b68-9d82-4c6d-86a6-1071a9e0f79f",
-  "version": 34,
+  "version": 35,
   "values": [
     {
       "meta": {
@@ -2992,6 +2992,16 @@
           "http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/"
         ]
       }
+    },
+    {
+      "value": "FormBook",
+      "description": "FormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016.",
+      "meta": {
+        "refs": [
+          "https://www.fireeye.com/blog/threat-research/2017/10/formbook-malware-distribution-campaigns.html",
+          "https://www.arbornetworks.com/blog/asert/formidable-formbook-form-grabber/"
+        ]
+      }
     }
   ]
 }