{
	"id": "00038195-a713-4530-9be3-2bf720d684b2",
	"created_at": "2026-04-06T00:14:12.045144Z",
	"updated_at": "2026-04-10T03:29:54.652879Z",
	"deleted_at": null,
	"sha1_hash": "30e20ca28a3bbbc43686d3f49a20a06ff32fabcf",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 49026,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 18:06:18 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool REPTILE\n Tool: REPTILE\nNames REPTILE\nCategory Malware\nType Backdoor\nDescription\n(Mandiant) To achieve persistent access on the FortiManager device, the threat actor deployed\na backdoor with the filename /bin/klogd (MD5: 53a69adac914808eced2bf8155a7512d) that\nMandiant refers to as REPTILE, a variant of a publicly available Linux kernel module (LKM)\nrootkit. With the assistance of TABLEFLIP, the threat actor was able to successfully forward\ntraffic and access the REPTILE backdoor using iptables traffic redirection rules.\nOnce executed, REPTILE created a packet socket to receive OSI layer 2 packets. When a\npacket was received, the backdoor would perform the check seen in the pseudocode in Figure\n20 to determine if a magic string was present.\nInformation Malpedia Last change to this tool card: 27 August 2024\nDownload this tool card in JSON format\nAll groups using tool REPTILE\nChanged Name Country Observed\nAPT groups\n UNC3886 2021-Early 2025\n1 group listed (1 APT, 0 other, 0 unknown)\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e6153a12-1a8f-4727-8c7d-dfe7ea45cc67\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e6153a12-1a8f-4727-8c7d-dfe7ea45cc67\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e6153a12-1a8f-4727-8c7d-dfe7ea45cc67\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e6153a12-1a8f-4727-8c7d-dfe7ea45cc67"
	],
	"report_names": [
		"listgroups.cgi?u=e6153a12-1a8f-4727-8c7d-dfe7ea45cc67"
	],
	"threat_actors": [
		{
			"id": "9df8987a-27fc-45c5-83b0-20dceb8288af",
			"created_at": "2025-10-29T02:00:51.836932Z",
			"updated_at": "2026-04-10T02:00:05.253487Z",
			"deleted_at": null,
			"main_name": "UNC3886",
			"aliases": [
				"UNC3886"
			],
			"source_name": "MITRE:UNC3886",
			"tools": [
				"MOPSLED",
				"VIRTUALPIE",
				"CASTLETAP",
				"THINCRUST",
				"VIRTUALPITA",
				"RIFLESPINE"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "a08d93aa-41e4-4eca-a0fd-002d051a2c2d",
			"created_at": "2024-08-28T02:02:09.711951Z",
			"updated_at": "2026-04-10T02:00:04.957678Z",
			"deleted_at": null,
			"main_name": "UNC3886",
			"aliases": [
				"Fire Ant"
			],
			"source_name": "ETDA:UNC3886",
			"tools": [
				"BOLDMOVE",
				"CASTLETAP",
				"LOOKOVER",
				"MOPSLED",
				"RIFLESPINE",
				"TABLEFLIP",
				"THINCRUST",
				"Tiny SHell",
				"VIRTUALGATE",
				"VIRTUALPIE",
				"VIRTUALPITA",
				"VIRTUALSHINE",
				"tsh"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "1c91699d-77d3-4ad7-9857-9f9196ac1e37",
			"created_at": "2023-11-04T02:00:07.663664Z",
			"updated_at": "2026-04-10T02:00:03.385989Z",
			"deleted_at": null,
			"main_name": "UNC3886",
			"aliases": [],
			"source_name": "MISPGALAXY:UNC3886",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434452,
	"ts_updated_at": 1775791794,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/30e20ca28a3bbbc43686d3f49a20a06ff32fabcf.pdf",
		"text": "https://archive.orkl.eu/30e20ca28a3bbbc43686d3f49a20a06ff32fabcf.txt",
		"img": "https://archive.orkl.eu/30e20ca28a3bbbc43686d3f49a20a06ff32fabcf.jpg"
	}
}