{
	"id": "84b5ce52-ee42-434b-83f8-11095ba2bbbd",
	"created_at": "2026-04-06T01:28:55.099393Z",
	"updated_at": "2026-04-10T03:37:55.899921Z",
	"deleted_at": null,
	"sha1_hash": "3564bb8e416cd96ba28445f8bd0f82bf3303ed82",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51971,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 00:50:59 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Stealer\n Tool: Stealer\nNames Stealer\nCategory Malware\nType Keylogger\nDescription A simple keylogger with an easy-to-use builder application.\nInformation Last change to this tool card: 20 April 2020\nDownload this tool card in JSON format\nAll groups using tool Stealer\nChanged Name Country Observed\nAPT groups\n Flying Kitten, Ajax Security Team 2010-2013\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8a624840-0db3-4361-8e9f-d7a6e2d0f714\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8a624840-0db3-4361-8e9f-d7a6e2d0f714\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=8a624840-0db3-4361-8e9f-d7a6e2d0f714"
	],
	"report_names": [
		"listgroups.cgi?u=8a624840-0db3-4361-8e9f-d7a6e2d0f714"
	],
	"threat_actors": [
		{
			"id": "8e1bae2f-2a21-4ba8-a6f1-42155f96aec8",
			"created_at": "2022-10-25T16:07:23.645758Z",
			"updated_at": "2026-04-10T02:00:04.700158Z",
			"deleted_at": null,
			"main_name": "Flying Kitten",
			"aliases": [
				"Ajax Security Team",
				"Flying Kitten",
				"G0130",
				"Group 26",
				"Operation Saffron Rose"
			],
			"source_name": "ETDA:Flying Kitten",
			"tools": [
				"Stealer"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "f4d7cba1-dbdd-42a9-88c5-4d0c81659ee0",
			"created_at": "2023-01-06T13:46:38.357581Z",
			"updated_at": "2026-04-10T02:00:02.941254Z",
			"deleted_at": null,
			"main_name": "Flying Kitten",
			"aliases": [
				"Saffron Rose",
				"AjaxSecurityTeam",
				"Ajax Security Team",
				"Group 26",
				"Sayad",
				"SaffronRose"
			],
			"source_name": "MISPGALAXY:Flying Kitten",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "8faa11f5-2a14-479c-9ea8-3779e6de9749",
			"created_at": "2022-10-25T15:50:23.814205Z",
			"updated_at": "2026-04-10T02:00:05.308465Z",
			"deleted_at": null,
			"main_name": "Ajax Security Team",
			"aliases": [
				"Ajax Security Team",
				"Operation Woolen-Goldfish",
				"AjaxTM",
				"Rocket Kitten",
				"Flying Kitten",
				"Operation Saffron Rose"
			],
			"source_name": "MITRE:Ajax Security Team",
			"tools": [
				"sqlmap",
				"Havij"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775438935,
	"ts_updated_at": 1775792275,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3564bb8e416cd96ba28445f8bd0f82bf3303ed82.pdf",
		"text": "https://archive.orkl.eu/3564bb8e416cd96ba28445f8bd0f82bf3303ed82.txt",
		"img": "https://archive.orkl.eu/3564bb8e416cd96ba28445f8bd0f82bf3303ed82.jpg"
	}
}