{
	"id": "ea4b8ea1-9c57-4e92-bd86-a75461173473",
	"created_at": "2026-04-06T00:21:22.506282Z",
	"updated_at": "2026-04-10T03:25:18.478019Z",
	"deleted_at": null,
	"sha1_hash": "013f97cb2ffa6ac41fc883bc330e17e3e96d609e",
	"title": "MBS BTC Stealer - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43688,
	"plain_text": "MBS BTC Stealer - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 13:52:15 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool MBS BTC Stealer\r\n Tool: MBS BTC Stealer\r\nNames MBS BTC Stealer\r\nCategory Malware\r\nType Credential stealer\r\nDescription No description available yet.\r\nInformation\r\n\u003chttps://www.privacysecurityacademy.com/wp-content/uploads/2019/10/CrowdStrike-2019-\r\nGlobal-Threat-Report.pdf\u003e\r\nLast change to this tool card: 20 April 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool MBS BTC Stealer\r\nChanged Name Country Observed\r\nOther groups\r\n  Guru Spider 2014-Mar 2018  \r\n1 group listed (0 APT, 1 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5b9d903e-f021-4a8b-8742-6bf6383c5306\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5b9d903e-f021-4a8b-8742-6bf6383c5306\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=5b9d903e-f021-4a8b-8742-6bf6383c5306"
	],
	"report_names": [
		"listgroups.cgi?u=5b9d903e-f021-4a8b-8742-6bf6383c5306"
	],
	"threat_actors": [
		{
			"id": "64ac8ebd-4cd6-410b-83f3-f3ef25b59156",
			"created_at": "2022-10-25T16:07:24.494373Z",
			"updated_at": "2026-04-10T02:00:05.009827Z",
			"deleted_at": null,
			"main_name": "Guru Spider",
			"aliases": [],
			"source_name": "ETDA:Guru Spider",
			"tools": [
				"MBS BTC Stealer",
				"MKL Pro Keylogger",
				"Madness PRO DDoS",
				"Quant Loader",
				"QuantLoader",
				"Z*Stealer",
				"ZStealer"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "bc28c4ad-2d4b-47f4-8303-7360a9e72570",
			"created_at": "2023-01-06T13:46:38.900931Z",
			"updated_at": "2026-04-10T02:00:03.13942Z",
			"deleted_at": null,
			"main_name": "GURU SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:GURU SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434882,
	"ts_updated_at": 1775791518,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/013f97cb2ffa6ac41fc883bc330e17e3e96d609e.pdf",
		"text": "https://archive.orkl.eu/013f97cb2ffa6ac41fc883bc330e17e3e96d609e.txt",
		"img": "https://archive.orkl.eu/013f97cb2ffa6ac41fc883bc330e17e3e96d609e.jpg"
	}
}