{
	"id": "49ea2059-6881-4adb-8f29-a3c9e2833450",
	"created_at": "2026-04-06T00:16:13.644405Z",
	"updated_at": "2026-04-10T03:21:03.501674Z",
	"deleted_at": null,
	"sha1_hash": "287423ced261f0887527de40076a5bcc783deadf",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 49130,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 21:15:39 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool ZeusVM\n Tool: ZeusVM\nNames\nZeusVM\nVM Zeus\nVMzeus\nZberp\nCategory Malware\nType Banking trojan, Credential stealer\nDescription\n(Malwarebytes) When an infected user loads their banking website, the Trojan starts\nacting as man-in-the-middle and can literally empty out his bank account in total\ndiscretion. The bank cannot tell these are illegal money transfers since the customer was\nproperly authenticated into their system.\nInformation\nMalpedia AlienVault OTX Last change to this tool card: 28 December 2022\nDownload this tool card in JSON format\nAll groups using tool ZeusVM\nChanged Name Country Observed\nUnknown groups\n _[ Interesting malware not linked to an actor yet ]_\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=11172947-4164-4cc2-b8db-7155adc5085c\nPage 1 of 2\n\n1 group listed (0 APT, 0 other, 1 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=11172947-4164-4cc2-b8db-7155adc5085c\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=11172947-4164-4cc2-b8db-7155adc5085c\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=11172947-4164-4cc2-b8db-7155adc5085c"
	],
	"report_names": [
		"listgroups.cgi?u=11172947-4164-4cc2-b8db-7155adc5085c"
	],
	"threat_actors": [],
	"ts_created_at": 1775434573,
	"ts_updated_at": 1775791263,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/287423ced261f0887527de40076a5bcc783deadf.pdf",
		"text": "https://archive.orkl.eu/287423ced261f0887527de40076a5bcc783deadf.txt",
		"img": "https://archive.orkl.eu/287423ced261f0887527de40076a5bcc783deadf.jpg"
	}
}