{
	"id": "e0abafca-6fd0-4f60-a054-aeb80e299703",
	"created_at": "2026-04-06T00:18:59.615428Z",
	"updated_at": "2026-04-10T03:26:42.28537Z",
	"deleted_at": null,
	"sha1_hash": "3775da9140a64bb791524e6aecef269feea8a0c1",
	"title": "Operation RestyLink - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 42931,
	"plain_text": "Operation RestyLink - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 15:33:18 UTC\r\nHome \u003e List all groups \u003e Operation RestyLink\r\n APT group: Operation RestyLink\r\nNames\r\nOperation RestyLink (NTT)\r\nOperation Enelink (?)\r\nEarth Yako (Trend Micro)\r\nCountry [Unknown]\r\nMotivation Information theft and espionage\r\nFirst seen 2021\r\nDescription\r\n(NTT) Our SOC observed APT campaign targeting Japanese companies starting from mid of\r\nApril 2022. We think that this campaign had already started in March 2022 and related attack\r\nmight have performed around October 2021. It implies that this campaign is not temporary nor\r\nintensive, and it could continue from here forward.\r\nObserved Countries: Japan.\r\nTools used\r\nInformation\r\n\u003chttps://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies\u003e\r\nLast change to this card: 17 February 2023\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=77129bef-3a35-4ebb-a51e-fb04b22fcb25\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=77129bef-3a35-4ebb-a51e-fb04b22fcb25\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=77129bef-3a35-4ebb-a51e-fb04b22fcb25"
	],
	"report_names": [
		"showcard.cgi?u=77129bef-3a35-4ebb-a51e-fb04b22fcb25"
	],
	"threat_actors": [
		{
			"id": "46818902-c96d-445c-afdb-075ef6b4afab",
			"created_at": "2023-02-18T02:04:24.443028Z",
			"updated_at": "2026-04-10T02:00:04.828275Z",
			"deleted_at": null,
			"main_name": "Operation RestyLink",
			"aliases": [
				"Earth Yako",
				"Operation Enelink"
			],
			"source_name": "ETDA:Operation RestyLink",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "65e1eee1-bc35-4093-9554-1a668e1bc30a",
			"created_at": "2024-02-08T02:00:04.320426Z",
			"updated_at": "2026-04-10T02:00:03.583546Z",
			"deleted_at": null,
			"main_name": "Earth Yako",
			"aliases": [
				"Operation RestyLink",
				"Enelink"
			],
			"source_name": "MISPGALAXY:Earth Yako",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434739,
	"ts_updated_at": 1775791602,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3775da9140a64bb791524e6aecef269feea8a0c1.pdf",
		"text": "https://archive.orkl.eu/3775da9140a64bb791524e6aecef269feea8a0c1.txt",
		"img": "https://archive.orkl.eu/3775da9140a64bb791524e6aecef269feea8a0c1.jpg"
	}
}