{
	"id": "b441c1b5-fd82-42f9-9d53-702de648d4e0",
	"created_at": "2026-04-06T01:31:27.324309Z",
	"updated_at": "2026-04-10T13:12:40.111008Z",
	"deleted_at": null,
	"sha1_hash": "25aea9c1e4a1fb3327d7d2f1de8bf680adb52c4e",
	"title": "Operation Dragon Castling - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45761,
	"plain_text": "Operation Dragon Castling - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-06 00:25:48 UTC\nHome \u003e List all groups \u003e Operation Dragon Castling\n APT group: Operation Dragon Castling\nNames Operation Dragon Castling (ESET)\nCountry China\nMotivation Information theft and espionage\nFirst seen 2022\nDescription\n(ESET) We recently discovered an APT campaign we are calling Operation Dragon Castling.\nThe campaign is targeting what appears to be betting companies in South East Asia, more\nspecifically companies located in Taiwan, the Philippines, and Hong Kong. With moderate\nconfidence, we can attribute the campaign to a Chinese speaking APT group, but unfortunately\ncannot attribute the attack to a specific group and are not sure what the attackers are after.\nObserved\nSectors: Casinos and Gambling.\nCountries: Hong Kong, Philippines, Taiwan.\nTools used\nInformation\nLast change to this card: 04 April 2022\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=c139db43-c6b8-4b2d-8203-99af28f01adf\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=c139db43-c6b8-4b2d-8203-99af28f01adf\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=c139db43-c6b8-4b2d-8203-99af28f01adf"
	],
	"report_names": [
		"showcard.cgi?u=c139db43-c6b8-4b2d-8203-99af28f01adf"
	],
	"threat_actors": [
		{
			"id": "06260304-49f9-4d51-a22d-373c7fcb80ca",
			"created_at": "2022-10-25T16:07:23.944881Z",
			"updated_at": "2026-04-10T02:00:04.801806Z",
			"deleted_at": null,
			"main_name": "Operation Dragon Castling",
			"aliases": [],
			"source_name": "ETDA:Operation Dragon Castling",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775439087,
	"ts_updated_at": 1775826760,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/25aea9c1e4a1fb3327d7d2f1de8bf680adb52c4e.pdf",
		"text": "https://archive.orkl.eu/25aea9c1e4a1fb3327d7d2f1de8bf680adb52c4e.txt",
		"img": "https://archive.orkl.eu/25aea9c1e4a1fb3327d7d2f1de8bf680adb52c4e.jpg"
	}
}