{ "id": "3b58f65d-51a1-40d4-885e-f6965c9274b8", "created_at": "2026-04-06T00:14:08.004097Z", "updated_at": "2026-04-10T13:12:47.874423Z", "deleted_at": null, "sha1_hash": "0df3333e1485af582041d9501b6b0a30747185b6", "title": "Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 51678, "plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 22:30:40 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool XtremeRAT\r\n Tool: XtremeRAT\r\nNames\r\nXtremeRAT\r\nXtreme RAT\r\nExtRat\r\nCategory Tools\r\nType Backdoor, Keylogger, Info stealer, Exfiltration\r\nDescription\r\nA publicly available RAT.\r\n(FireEye) XtremeRAT allows an attacker to:\r\n• Interact with the victim via a remote shell\r\n• Upload/download files\r\n• Interact with the registry\r\n• Manipulate running processes and services\r\n• Capture images of the desktop\r\n• Record from connected devices, such as a webcam or microphone\r\nMoreover, during the build process, the attacker can specify whether to include\r\nkeylogging and USB infection functions.\r\nInformation\r\n\u003chttps://www.fireeye.com/blog/threat-research/2014/02/xtremerat-nuisance-or-threat.html\u003e\r\n\u003chttps://community.rsa.com/community/products/netwitness/blog/2017/08/02/malspam-delivers-xtreme-rat-8-1-2017\u003e\r\n\u003chttps://www.symantec.com/connect/blogs/colombians-major-target-email-campaigns-delivering-xtreme-rat\u003e\r\n\u003chttps://malware.lu/articles/2012/07/22/xtreme-rat-analysis.html\u003e\r\nMalpedia \u003chttps://malpedia.caad.fkie.fraunhofer.de/details/win.extreme_rat\u003e\r\nAlienVault OTX \u003chttps://otx.alienvault.com/browse/pulses?q=tag:xtremerat\u003e\r\nLast change to this tool card: 28 December 2022\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=7886a052-0559-45f4-92ac-44366fe0791f\r\nPage 1 of 2\n\nDownload this tool card in JSON format\r\nAll groups using tool XtremeRAT\r\nChanged Name Country Observed\r\nAPT groups\r\n  Molerats, Extreme Jackal, Gaza Cybergang [Gaza] 2012-Jul 2023  \r\n  Packrat [Latin America] 2008  \r\n  TA558 [Unknown] 2018-Jun 2023  \r\n3 groups listed (3 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=7886a052-0559-45f4-92ac-44366fe0791f\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=7886a052-0559-45f4-92ac-44366fe0791f\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=7886a052-0559-45f4-92ac-44366fe0791f" ], "report_names": [ "listgroups.cgi?u=7886a052-0559-45f4-92ac-44366fe0791f" ], "threat_actors": [ { "id": "316b23b5-e097-4dc6-8b1c-d096860c6c16", "created_at": "2022-10-25T16:07:24.290801Z", "updated_at": "2026-04-10T02:00:04.924688Z", "deleted_at": null, "main_name": "TA558", "aliases": [], "source_name": "ETDA:TA558", "tools": [ "AZORult", "AsyncRAT", "Bladabindi", "ExtRat", "Jorik", "Loda", "Loda RAT", "LodaRAT", "Nymeria", "PuffStealer", "Remcos", "RemcosRAT", "Remvio", "Revenge RAT", "RevengeRAT", "Revetrat", "Rultazo", "Socmer", "Vengeance Justice Worm", "Vjw0rm", "Xtreme RAT", "XtremeRAT", "njRAT" ], "source_id": "ETDA", "reports": null }, { "id": "0c502f6d-640d-4e69-bfb8-328ba6540d4f", "created_at": "2022-10-25T15:50:23.756782Z", "updated_at": "2026-04-10T02:00:05.324924Z", "deleted_at": null, "main_name": "Molerats", "aliases": [ "Molerats", "Operation Molerats", "Gaza Cybergang" ], "source_name": "MITRE:Molerats", "tools": [ "MoleNet", "DustySky", "DropBook", "SharpStage", "PoisonIvy" ], "source_id": "MITRE", "reports": null }, { "id": "d001e298-8608-4ee6-96c7-e5afb62d718d", "created_at": "2022-10-25T16:07:24.035765Z", "updated_at": "2026-04-10T02:00:04.847015Z", "deleted_at": null, "main_name": "Packrat", "aliases": [], "source_name": "ETDA:Packrat", "tools": [ "Adwind", "Adwind RAT", "Adzok", "Alien Spy", "AlienSpy", "CyberGate", "CyberGate RAT", "ExtRat", "Frutas", "Invisible Remote Administrator", "JBifrost RAT", "JSocket", "Rebhip", "Sockrat", "Trojan.Maljava", "UnReCoM", "Unknown RAT", "Unrecom", "Xtreme RAT", "XtremeRAT", "jBiFrost", "jConnectPro RAT", "jFrutas" ], "source_id": "ETDA", "reports": null }, { "id": "e5cad6bf-fa91-4128-ba0d-2bf3ff3c6c6b", "created_at": "2025-08-07T02:03:24.53077Z", "updated_at": "2026-04-10T02:00:03.680525Z", "deleted_at": null, "main_name": "ALUMINUM SARATOGA", "aliases": [ "APT-C-23", "Arid Viper", "Desert Falcon", "Extreme Jackal ", "Gaza Cybergang", "Molerats ", "Operation DustySky ", "TA402" ], "source_name": "Secureworks:ALUMINUM SARATOGA", "tools": [ "BlackShades", "BrittleBush", "DarkComet", "LastConn", "Micropsia", "NimbleMamba", "PoisonIvy", "QuasarRAT", "XtremeRat" ], "source_id": "Secureworks", "reports": null }, { "id": "1162e0d4-b69c-423d-a4da-f3080d1d2b0c", "created_at": "2023-01-06T13:46:38.508262Z", "updated_at": "2026-04-10T02:00:03.006018Z", "deleted_at": null, "main_name": "Molerats", "aliases": [ "Gaza Cybergang", "Operation Molerats", "Extreme Jackal", "ALUMINUM SARATOGA", "G0021", "BLACKSTEM", "Gaza Hackers Team", "Gaza cybergang" ], "source_name": "MISPGALAXY:Molerats", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "02a7064e-447b-433e-ac14-6f10d476f517", "created_at": "2023-01-06T13:46:38.520097Z", "updated_at": "2026-04-10T02:00:03.010392Z", "deleted_at": null, "main_name": "Packrat", "aliases": [], "source_name": "MISPGALAXY:Packrat", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "cf91b389-9602-45c0-8d6b-c61d14800f54", "created_at": "2023-01-06T13:46:39.448277Z", "updated_at": "2026-04-10T02:00:03.332604Z", "deleted_at": null, "main_name": "TA558", "aliases": [], "source_name": "MISPGALAXY:TA558", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "847f600c-cf90-44c0-8b39-fb0d5adfcef4", "created_at": "2022-10-25T16:07:23.875541Z", "updated_at": "2026-04-10T02:00:04.768142Z", "deleted_at": null, "main_name": "Molerats", "aliases": [ "ATK 89", "Aluminum Saratoga", "Extreme Jackal", "G0021", "Gaza Cybergang", "Gaza Hackers Team", "Molerats", "Operation DustySky", "Operation DustySky Part 2", "Operation Molerats", "Operation Moonlight", "Operation SneakyPastes", "Operation TopHat", "TA402", "TAG-CT5" ], "source_name": "ETDA:Molerats", "tools": [ "BadPatch", "Bladabindi", "BrittleBush", "Chymine", "CinaRAT", "Darkmoon", "Downeks", "DropBook", "DustySky", "ExtRat", "Gen:Trojan.Heur.PT", "H-Worm", "H-Worm RAT", "Houdini", "Houdini RAT", "Hworm", "Iniduoh", "IronWind", "Jenxcus", "JhoneRAT", "Jorik", "KasperAgent", "Kognito", "LastConn", "Micropsia", "MoleNet", "Molerat Loader", "NeD Worm", "NimbleMamba", "Njw0rm", "Pierogi", "Poison Ivy", "Quasar RAT", "QuasarRAT", "SPIVY", "Scote", "SharpSploit", "SharpStage", "WSHRAT", "WelcomeChat", "Xtreme RAT", "XtremeRAT", "Yggdrasil", "dinihou", "dunihi", "njRAT", "pivy", "poisonivy" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434448, "ts_updated_at": 1775826767, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/0df3333e1485af582041d9501b6b0a30747185b6.pdf", "text": "https://archive.orkl.eu/0df3333e1485af582041d9501b6b0a30747185b6.txt", "img": "https://archive.orkl.eu/0df3333e1485af582041d9501b6b0a30747185b6.jpg" } }