diff --git a/elements/adversary-groups.json b/elements/adversary-groups.json
index c06a35d..bddfc81 100644
--- a/elements/adversary-groups.json
+++ b/elements/adversary-groups.json
@@ -781,6 +781,7 @@
     "Alexandre Dulaunoy",
     "Florian Roth",
     "Thomas Schreck",
+    "Timo Steffens",
     "Various"
   ],
   "description": "Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign.",
diff --git a/elements/threat-actor-tools.json b/elements/threat-actor-tools.json
index d6069a0..7e8877f 100644
--- a/elements/threat-actor-tools.json
+++ b/elements/threat-actor-tools.json
@@ -399,6 +399,6 @@
   ],
   "version" : 1,
   "description": "threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.",
-  "author": ["Alexandre Dulaunoy", "Florian Roth"],
+  "author": ["Alexandre Dulaunoy", "Florian Roth", "Timo Steffens"],
   "type": "threat-actor-tools"
 }