{
	"id": "27ed0edf-0579-4751-a38d-ffda51bb5281",
	"created_at": "2026-04-06T00:06:27.760323Z",
	"updated_at": "2026-04-10T03:37:17.450994Z",
	"deleted_at": null,
	"sha1_hash": "131c61aaebcb6846b4c8c9aa48ee489bd26927ec",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43613,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 22:05:16 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool glue30.dll\n Tool: glue30.dll\nNames glue30.dll\nCategory Malware\nType Keylogger\nDescription\n(Kaspersky) The glue30.dll malware module provides keylogging functionality. The\nupdater.mod module uses the Win API function SetWindowsHookExW to install hooks for the\nkeyboard and to inject glue30.dll into processes that get keyboard input. After that, glue30.dll\nloads and begins intercepting input in the context of each hooked process.\nInformation Last change to this tool card: 20 April 2020\nDownload this tool card in JSON format\nAll groups using tool glue30.dll\nChanged Name Country Observed\nAPT groups\n DarkUniverse [Unknown] 2017\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=83b4e3f9-419c-4382-a035-6490a4901d2a\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=83b4e3f9-419c-4382-a035-6490a4901d2a\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=83b4e3f9-419c-4382-a035-6490a4901d2a"
	],
	"report_names": [
		"listgroups.cgi?u=83b4e3f9-419c-4382-a035-6490a4901d2a"
	],
	"threat_actors": [
		{
			"id": "9a58d7bb-dd32-41bc-804e-500ef7550cf8",
			"created_at": "2023-01-06T13:46:39.131811Z",
			"updated_at": "2026-04-10T02:00:03.2252Z",
			"deleted_at": null,
			"main_name": "ItaDuke",
			"aliases": [
				"DarkUniverse",
				"SIG27"
			],
			"source_name": "MISPGALAXY:ItaDuke",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "59ce37c7-ce10-4cc3-ab27-c784a8a0898a",
			"created_at": "2022-10-25T16:07:23.534403Z",
			"updated_at": "2026-04-10T02:00:04.645423Z",
			"deleted_at": null,
			"main_name": "DarkUniverse",
			"aliases": [],
			"source_name": "ETDA:DarkUniverse",
			"tools": [
				"dfrgntfs5.sqt",
				"glue30.dll",
				"msvcrt58.sqt",
				"updater.mod",
				"zl4vq.sqt"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775433987,
	"ts_updated_at": 1775792237,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/131c61aaebcb6846b4c8c9aa48ee489bd26927ec.pdf",
		"text": "https://archive.orkl.eu/131c61aaebcb6846b4c8c9aa48ee489bd26927ec.txt",
		"img": "https://archive.orkl.eu/131c61aaebcb6846b4c8c9aa48ee489bd26927ec.jpg"
	}
}