{
	"id": "049d1ef2-3ef2-4c45-9fd3-c9948fc53866",
	"created_at": "2026-04-06T00:11:12.122636Z",
	"updated_at": "2026-04-10T03:26:42.722565Z",
	"deleted_at": null,
	"sha1_hash": "3c094cd99433c7e93f3b58831ebf328ea5f42e3d",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43304,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 17:33:20 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Cahnadr\n Tool: Cahnadr\nNames\nCahnadr\nNDriver\nCategory Malware\nType Rootkit\nDescription\n(Kaspersky) Canhadr, also known as NDriver, contains low-level routines for network, IO\noperations and so on. Its kernel-mode program is able to execute malicious code without\ncrashing the whole file system or causing Blue Screen – a remarkable achievement. Written in\npure C language, Canhadr/Ndriver provides full access to the hard drive and operating\nmemory despite device security restrictions, and carries out integrity control of various system\ncomponents to avoid debugging and security detection.\nInformation Last change to this tool card: 20 April 2020\nDownload this tool card in JSON format\nAll groups using tool Cahnadr\nChanged Name Country Observed\nAPT groups\n Slingshot [Unknown] 2012\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9e0e8a79-075a-49d4-b3a4-5cb6cde5369e\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9e0e8a79-075a-49d4-b3a4-5cb6cde5369e\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=9e0e8a79-075a-49d4-b3a4-5cb6cde5369e"
	],
	"report_names": [
		"listgroups.cgi?u=9e0e8a79-075a-49d4-b3a4-5cb6cde5369e"
	],
	"threat_actors": [
		{
			"id": "72aaa00d-4dcb-4f50-934c-326c84ca46e3",
			"created_at": "2023-01-06T13:46:38.995743Z",
			"updated_at": "2026-04-10T02:00:03.175285Z",
			"deleted_at": null,
			"main_name": "Slingshot",
			"aliases": [],
			"source_name": "MISPGALAXY:Slingshot",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f55c7778-a41c-4fc6-a2e7-fa970c5295f2",
			"created_at": "2022-10-25T16:07:24.198891Z",
			"updated_at": "2026-04-10T02:00:04.897342Z",
			"deleted_at": null,
			"main_name": "Slingshot",
			"aliases": [],
			"source_name": "ETDA:Slingshot",
			"tools": [
				"Cahnadr",
				"GollumApp",
				"NDriver"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434272,
	"ts_updated_at": 1775791602,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3c094cd99433c7e93f3b58831ebf328ea5f42e3d.pdf",
		"text": "https://archive.orkl.eu/3c094cd99433c7e93f3b58831ebf328ea5f42e3d.txt",
		"img": "https://archive.orkl.eu/3c094cd99433c7e93f3b58831ebf328ea5f42e3d.jpg"
	}
}