{
	"id": "b78a9e08-d33e-469c-a9bf-1277415d4e91",
	"created_at": "2026-04-06T00:12:42.218274Z",
	"updated_at": "2026-04-10T03:37:19.253984Z",
	"deleted_at": null,
	"sha1_hash": "2f790d9bfc601a5a2d8b9b6d4f29cf46632382d0",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48713,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 19:21:15 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool BrowsingHistoryView\r\n Tool: BrowsingHistoryView\r\nNames BrowsingHistoryView\r\nCategory Tools\r\nType Info stealer\r\nDescription\r\nBrowsingHistoryView is a utility that reads the history data of different Web browsers\r\n(Mozilla Firefox, Google Chrome, Internet Explorer, Microsoft Edge, Opera) and displays the\r\nbrowsing history of all these Web browsers in one table. The browsing history table includes\r\nthe following information: Visited URL, Title, Visit Time, Visit Count, Web browser and User\r\nProfile. BrowsingHistoryView allows you to watch the browsing history of all user profiles in\r\na running system, as well as to get the browsing history from external hard drive.\r\nYou can also export the browsing history into csv/tab-delimited/html/xml file from the user\r\ninterface, or from command-line, without displaying any user interface.\r\nInformation \u003chttps://www.nirsoft.net/utils/browsing_history_view.html\u003e\r\nLast change to this tool card: 04 June 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool BrowsingHistoryView\r\nChanged Name Country Observed\r\nAPT groups\r\n  Goblin Panda, Cycldek, Conimes 2013-Jun 2020  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1d94fa72-7b5a-40f1-a2a3-bf038bad3815\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1d94fa72-7b5a-40f1-a2a3-bf038bad3815\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1d94fa72-7b5a-40f1-a2a3-bf038bad3815"
	],
	"report_names": [
		"listgroups.cgi?u=1d94fa72-7b5a-40f1-a2a3-bf038bad3815"
	],
	"threat_actors": [
		{
			"id": "7d553b83-a7b2-431f-9bc9-08da59f3c4ea",
			"created_at": "2023-01-06T13:46:39.444946Z",
			"updated_at": "2026-04-10T02:00:03.331753Z",
			"deleted_at": null,
			"main_name": "GOBLIN PANDA",
			"aliases": [
				"Conimes",
				"Cycldek"
			],
			"source_name": "MISPGALAXY:GOBLIN PANDA",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2c7ecb0e-337c-478f-95d4-7dbe9ba44c39",
			"created_at": "2022-10-25T16:07:23.690871Z",
			"updated_at": "2026-04-10T02:00:04.709966Z",
			"deleted_at": null,
			"main_name": "Goblin Panda",
			"aliases": [
				"1937CN",
				"Conimes",
				"Cycldek",
				"Goblin Panda"
			],
			"source_name": "ETDA:Goblin Panda",
			"tools": [
				"8.t Dropper",
				"8.t RTF exploit builder",
				"8t_dropper",
				"Agent.dhwf",
				"BackDoor-FBZT!52D84425CDF2",
				"BlueCore",
				"BrowsingHistoryView",
				"ChromePass",
				"CoreLoader",
				"Custom HDoor",
				"Destroy RAT",
				"DestroyRAT",
				"DropPhone",
				"FoundCore",
				"HDoor",
				"HTTPTunnel",
				"JsonCookies",
				"Kaba",
				"Korplug",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"NBTscan",
				"NewCore RAT",
				"PlugX",
				"ProcDump",
				"PsExec",
				"QCRat",
				"RainyDay",
				"RedCore",
				"RedDelta",
				"RoyalRoad",
				"Sisfader",
				"Sisfader RAT",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trojan.Win32.Staser.ytq",
				"USBCulprit",
				"Win32/Zegost.BW",
				"Xamtrav",
				"ZeGhost",
				"nbtscan"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434362,
	"ts_updated_at": 1775792239,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2f790d9bfc601a5a2d8b9b6d4f29cf46632382d0.pdf",
		"text": "https://archive.orkl.eu/2f790d9bfc601a5a2d8b9b6d4f29cf46632382d0.txt",
		"img": "https://archive.orkl.eu/2f790d9bfc601a5a2d8b9b6d4f29cf46632382d0.jpg"
	}
}