{
	"id": "f3ed8559-466f-4146-aef0-463e88c4117f",
	"created_at": "2026-04-06T00:12:12.998307Z",
	"updated_at": "2026-04-10T03:33:52.168628Z",
	"deleted_at": null,
	"sha1_hash": "0111c027dcc56aa700164add4b77d4ab35e3dbc0",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48936,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 23:45:07 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool TinyLoader\n Tool: TinyLoader\nNames TinyLoader\nCategory Malware\nType Botnet, Downloader\nDescription\n(Fidelis) Tinyloader has a few unique characteristics\n• It is, in fact, tiny — typically weighing in under 5 KB.\n• Its command-and-control (C2) server runs on Microsoft Windows, which is fairly\nuncommon in malware today.\n• Finally, it is extremely versatile due to its modular C2 mechanism. This mechanism\nallows the C2 server to pass custom bytecode directly into the running memory of the bot\nmaking it easy to load new malware or augment additional malicious behaviors.\nInformation\nMalpedia AlienVault OTX Last change to this tool card: 14 May 2020\nDownload this tool card in JSON format\nAll groups using tool TinyLoader\nChanged Name Country Observed\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d69d3400-c249-4a42-aa2f-69ccee84c77a\nPage 1 of 2\n\nAPT groups\r\n  TA530 [Unknown] 2016-Nov 2016  \r\n  Tiny Spider [Unknown] 2015-2017  \r\n2 groups listed (2 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d69d3400-c249-4a42-aa2f-69ccee84c77a\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d69d3400-c249-4a42-aa2f-69ccee84c77a\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d69d3400-c249-4a42-aa2f-69ccee84c77a"
	],
	"report_names": [
		"listgroups.cgi?u=d69d3400-c249-4a42-aa2f-69ccee84c77a"
	],
	"threat_actors": [
		{
			"id": "f8fd6c94-f1bf-43b8-8613-edc46ca097ee",
			"created_at": "2022-10-25T16:07:24.285532Z",
			"updated_at": "2026-04-10T02:00:04.922819Z",
			"deleted_at": null,
			"main_name": "TA530",
			"aliases": [],
			"source_name": "ETDA:TA530",
			"tools": [
				"AbaddonPOS",
				"August Stealer",
				"Bugat v5",
				"CryptoWall",
				"Dofoil",
				"Dridex",
				"Gozi ISFB",
				"H1N1",
				"H1N1 Loader",
				"ISFB",
				"Nymaim",
				"Pandemyia",
				"Sharik",
				"Smoke Loader",
				"SmokeLoader",
				"SpY-Agent",
				"TVRAT",
				"TVSpy",
				"TeamSpy",
				"TeamViewerENT",
				"TinyLoader",
				"nymain"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "168848e1-54f8-43ba-b3f1-650be9b08081",
			"created_at": "2023-01-06T13:46:38.913608Z",
			"updated_at": "2026-04-10T02:00:03.143639Z",
			"deleted_at": null,
			"main_name": "TINY SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:TINY SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "ab0b3abd-7947-4a56-a03a-a3fd1009d89f",
			"created_at": "2022-10-25T16:07:24.326862Z",
			"updated_at": "2026-04-10T02:00:04.93806Z",
			"deleted_at": null,
			"main_name": "Tiny Spider",
			"aliases": [],
			"source_name": "ETDA:Tiny Spider",
			"tools": [
				"PinkKite",
				"PsExec",
				"TinyLoader",
				"TinyPOS"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "af77521e-c35f-4030-a95d-bcd1eaeeaac1",
			"created_at": "2023-01-06T13:46:38.476089Z",
			"updated_at": "2026-04-10T02:00:02.990237Z",
			"deleted_at": null,
			"main_name": "TA530",
			"aliases": [],
			"source_name": "MISPGALAXY:TA530",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434332,
	"ts_updated_at": 1775792032,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0111c027dcc56aa700164add4b77d4ab35e3dbc0.pdf",
		"text": "https://archive.orkl.eu/0111c027dcc56aa700164add4b77d4ab35e3dbc0.txt",
		"img": "https://archive.orkl.eu/0111c027dcc56aa700164add4b77d4ab35e3dbc0.jpg"
	}
}