{
	"id": "263d6bb0-c1bf-40eb-8a18-d70fd1e1c39f",
	"created_at": "2026-04-06T00:19:40.549097Z",
	"updated_at": "2026-04-10T03:35:42.498896Z",
	"deleted_at": null,
	"sha1_hash": "379f2d422c969a78cac951f91a00a691c409bbb0",
	"title": "Whitefly, Mofang - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 57907,
	"plain_text": "Whitefly, Mofang - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-02 12:02:55 UTC\r\nHome \u003e List all groups \u003e Whitefly, Mofang\r\n APT group: Whitefly, Mofang\r\nNames\r\nWhitefly (Symantec)\r\nMofang (Fox-IT)\r\nTEMP.Mimic (FireEye)\r\nBronze Walker (SecureWorks)\r\nATK 83 (Thales)\r\nSectorM04 (ThreatRecon)\r\nSuperman (?)\r\nG0103 (MITRE)\r\nG0107 (MITRE)\r\nCountry [Unknown]\r\nMotivation Information theft and espionage\r\nFirst seen 2012\r\nDescription\r\n(Fox-IT) Mofang is a threat actor that almost certainly operates out of China and is\r\nprobably government-affiliated. It is highly likely that Mofang’s targets are selected\r\nbased on involvement with investments, or technological advances that could be\r\nperceived as a threat to the Chinese sphere of influence. This is most clearly the case\r\nin a campaign focusing on government and critical infrastructure of Myanmar that is\r\ndescribed in this report. Chances are about even, though, that Mofang is a relevant\r\nthreat actor to any organization that invests in Myanmar or is otherwise politically\r\ninvolved. In addition to the campaign in Myanmar, Mofang has been observed to\r\nattack targets across multiple sectors (government, military, critical infrastructure\r\nand the automotive and weapon industries) in multiple countries.\r\nObserved\r\nSectors: Automotive, Critical infrastructure, Defense, Engineering, Government,\r\nHealthcare, Media, Telecommunications and weapon industries.\r\nCountries: Canada, Germany, India, Myanmar, Singapore, South Korea, USA.\r\nTools used Mimikatz, Nibatad, ShimRAT, Termite, Vcrodat, Living off the Land.\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=59308a4a-3c7b-4589-87e5-0c4d0d19274e\r\nPage 1 of 2\n\nOperations performed Jul 2018\nBreach of SingHealth\nInformation\nMITRE ATT\u0026CK\nLast change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=59308a4a-3c7b-4589-87e5-0c4d0d19274e\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=59308a4a-3c7b-4589-87e5-0c4d0d19274e\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=59308a4a-3c7b-4589-87e5-0c4d0d19274e"
	],
	"report_names": [
		"showcard.cgi?u=59308a4a-3c7b-4589-87e5-0c4d0d19274e"
	],
	"threat_actors": [
		{
			"id": "ad5c6ff2-0646-4b29-88bb-d88c75e4866d",
			"created_at": "2022-10-25T15:50:23.662882Z",
			"updated_at": "2026-04-10T02:00:05.385067Z",
			"deleted_at": null,
			"main_name": "Whitefly",
			"aliases": [
				"Whitefly"
			],
			"source_name": "MITRE:Whitefly",
			"tools": [
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "cd9f8d91-c55c-4086-a1a0-23e78d194d46",
			"created_at": "2023-01-06T13:46:38.943454Z",
			"updated_at": "2026-04-10T02:00:03.153969Z",
			"deleted_at": null,
			"main_name": "Whitefly",
			"aliases": [],
			"source_name": "MISPGALAXY:Whitefly",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "a2939cf7-76f8-4080-9ba1-42ccb4016b3b",
			"created_at": "2022-10-25T15:50:23.53328Z",
			"updated_at": "2026-04-10T02:00:05.372938Z",
			"deleted_at": null,
			"main_name": "Mofang",
			"aliases": [
				"Mofang"
			],
			"source_name": "MITRE:Mofang",
			"tools": [
				"ShimRatReporter",
				"ShimRat"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "db318f04-09e6-4c57-b0e9-3f71f0b2de94",
			"created_at": "2023-01-06T13:46:38.648954Z",
			"updated_at": "2026-04-10T02:00:03.054266Z",
			"deleted_at": null,
			"main_name": "Mofang",
			"aliases": [
				"BRONZE WALKER"
			],
			"source_name": "MISPGALAXY:Mofang",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "df9bfbf1-bb9d-492f-b381-95b9e1482267",
			"created_at": "2022-10-25T16:07:24.394491Z",
			"updated_at": "2026-04-10T02:00:04.973663Z",
			"deleted_at": null,
			"main_name": "Whitefly",
			"aliases": [
				"ATK 83",
				"Bronze Walker",
				"G0103",
				"G0107",
				"Mofang",
				"SectorM04",
				"TEMP.Mimic"
			],
			"source_name": "ETDA:Whitefly",
			"tools": [
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Mimikatz",
				"Nibatad",
				"Shim RAT",
				"ShimRAT",
				"Vcrodat"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "728d2c2c-c4af-4cdc-8723-5d3aa97924a8",
			"created_at": "2024-05-01T02:03:08.002557Z",
			"updated_at": "2026-04-10T02:00:03.669852Z",
			"deleted_at": null,
			"main_name": "BRONZE WALKER",
			"aliases": [
				"CTG-2810 ",
				"Mofang "
			],
			"source_name": "Secureworks:BRONZE WALKER",
			"tools": [
				"ShimRat",
				"Superman"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434780,
	"ts_updated_at": 1775792142,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/379f2d422c969a78cac951f91a00a691c409bbb0.pdf",
		"text": "https://archive.orkl.eu/379f2d422c969a78cac951f91a00a691c409bbb0.txt",
		"img": "https://archive.orkl.eu/379f2d422c969a78cac951f91a00a691c409bbb0.jpg"
	}
}