{
	"id": "f3f879e4-17ff-4f4e-a7e9-cee39dca0c9d",
	"created_at": "2026-04-06T00:12:53.078923Z",
	"updated_at": "2026-04-10T03:34:17.280462Z",
	"deleted_at": null,
	"sha1_hash": "0b9af35f772bf06c7518524d5dd9f7f0f52b316a",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 52130,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 18:34:46 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool IsSpace\n Tool: IsSpace\nNames\nIsSpace\nNfLog RAT\nCategory Malware\nType Reconnaissance, Backdoor\nDescription\n(Palo Alto) To determine the flow of execution, IsSpace gathers various data about the\ninfected host, such as administrative rights of the user, operating system version, and CPU\narchitecture.\nIf IsSpace determines that it is running as an administrator on a Microsoft Windows 7\nsystem on a 32-bit platform, it will attempt to execute itself accordingly, using a side-loading technique.\nInformation\nMalpedia AlienVault OTX Last change to this tool card: 23 April 2020\nDownload this tool card in JSON format\nAll groups using tool IsSpace\nChanged Name Country Observed\nAPT groups\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fc217926-738a-4c3e-8d5f-987259d84030\nPage 1 of 2\n\nDragonOK 2015-Jan 2017  \r\n  Samurai Panda 2009  \r\n2 groups listed (2 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fc217926-738a-4c3e-8d5f-987259d84030\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fc217926-738a-4c3e-8d5f-987259d84030\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fc217926-738a-4c3e-8d5f-987259d84030"
	],
	"report_names": [
		"listgroups.cgi?u=fc217926-738a-4c3e-8d5f-987259d84030"
	],
	"threat_actors": [
		{
			"id": "5ffe400c-6025-44c2-9aa1-7c34a7a192b0",
			"created_at": "2023-01-06T13:46:38.469688Z",
			"updated_at": "2026-04-10T02:00:02.987949Z",
			"deleted_at": null,
			"main_name": "DragonOK",
			"aliases": [
				"Moafee",
				"BRONZE OVERBROOK",
				"G0017",
				"G0002",
				"Shallow Taurus"
			],
			"source_name": "MISPGALAXY:DragonOK",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "4fda88fa-7c1f-4e84-b3c8-56f73f21aaf5",
			"created_at": "2022-10-25T16:07:24.147011Z",
			"updated_at": "2026-04-10T02:00:04.881289Z",
			"deleted_at": null,
			"main_name": "Samurai Panda",
			"aliases": [],
			"source_name": "ETDA:Samurai Panda",
			"tools": [
				"Agent.dhwf",
				"Destroy RAT",
				"DestroyRAT",
				"FF-RAT",
				"FormerFirstRAT",
				"Getkys",
				"IsSpace",
				"KABOB",
				"Kaba",
				"Korplug",
				"NfLog RAT",
				"PlugX",
				"Poldat",
				"RedDelta",
				"Sogu",
				"Sykipot",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Wkysol",
				"Xamtrav",
				"Zlib",
				"ffrat"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "7ebda3c6-1789-4d84-97cf-47fb18a0cb28",
			"created_at": "2022-10-25T15:50:23.78829Z",
			"updated_at": "2026-04-10T02:00:05.415039Z",
			"deleted_at": null,
			"main_name": "DragonOK",
			"aliases": [
				"DragonOK"
			],
			"source_name": "MITRE:DragonOK",
			"tools": [
				"PoisonIvy",
				"PlugX"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "2ac8fb39-1ad4-407c-bf51-249751a575ba",
			"created_at": "2023-01-06T13:46:38.337728Z",
			"updated_at": "2026-04-10T02:00:02.933527Z",
			"deleted_at": null,
			"main_name": "SAMURAI PANDA",
			"aliases": [
				"PLA Navy",
				"Wisp Team"
			],
			"source_name": "MISPGALAXY:SAMURAI PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "593dd07d-853c-46cd-8117-e24061034bbf",
			"created_at": "2025-08-07T02:03:24.648074Z",
			"updated_at": "2026-04-10T02:00:03.625859Z",
			"deleted_at": null,
			"main_name": "BRONZE OVERBROOK",
			"aliases": [
				"Danti ",
				"DragonOK ",
				"Samurai Panda ",
				"Shallow Taurus ",
				"Temp.DragonOK "
			],
			"source_name": "Secureworks:BRONZE OVERBROOK",
			"tools": [
				"Aveo",
				"DDKONG",
				"Godzilla Webshell",
				"HelloBridge",
				"IsSpace",
				"NFLog Trojan",
				"PLAINTEE",
				"PlugX",
				"Rambo"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "340d1673-0678-4e1f-8b75-30da2f65cc80",
			"created_at": "2022-10-25T16:07:23.552036Z",
			"updated_at": "2026-04-10T02:00:04.653109Z",
			"deleted_at": null,
			"main_name": "DragonOK",
			"aliases": [
				"Bronze Overbrook",
				"G0017",
				"Shallow Taurus"
			],
			"source_name": "ETDA:DragonOK",
			"tools": [
				"Agent.dhwf",
				"CT",
				"Chymine",
				"Darkmoon",
				"Destroy RAT",
				"DestroyRAT",
				"FF-RAT",
				"FormerFirstRAT",
				"Gen:Trojan.Heur.PT",
				"HTran",
				"HUC Packet Transmit Tool",
				"HelloBridge",
				"IsSpace",
				"KHRAT",
				"Kaba",
				"Korplug",
				"Mongall",
				"NFlog",
				"NewCT",
				"NfLog RAT",
				"PlugX",
				"Poison Ivy",
				"Rambo",
				"RedDelta",
				"SPIVY",
				"Sogu",
				"SysGet",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"TidePool",
				"Xamtrav",
				"brebsd",
				"ffrat",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434373,
	"ts_updated_at": 1775792057,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/0b9af35f772bf06c7518524d5dd9f7f0f52b316a.pdf",
		"text": "https://archive.orkl.eu/0b9af35f772bf06c7518524d5dd9f7f0f52b316a.txt",
		"img": "https://archive.orkl.eu/0b9af35f772bf06c7518524d5dd9f7f0f52b316a.jpg"
	}
}