diff --git a/APT34/README.MD b/APT34/README.MD
index 2524f4b..4bb7a71 100644
--- a/APT34/README.MD
+++ b/APT34/README.MD
@@ -7,3 +7,11 @@ https://malware-research.org/apt34-hacking-tools-leak/
 
 this man leak , telegram group
 https://web.telegram.org/#/im?p=@lab_dookhtegan
+
+Hacking tools:
+- Glimpse (newer version of a PowerShell-based trojan that Palo Alto Networks names BondUpdater)
+- PoisonFrog (older version of BondUpdater)
+- HyperShell (web shell that Palo Alto Networks calls TwoFace)
+- HighShell (another web shell)
+- Fox Panel (phishing kit)
+- Webmask (DNS tunneling, main tool behind DNSpionage)