{
	"id": "ee2ae5d2-b295-41ac-84cf-9424c23c5da8",
	"created_at": "2026-04-06T00:17:16.385875Z",
	"updated_at": "2026-04-10T13:13:09.95595Z",
	"deleted_at": null,
	"sha1_hash": "40761402946a1717409d9d330f5ca63d0038697a",
	"title": "Planetary Reef - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 41770,
	"plain_text": "Planetary Reef - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 16:11:47 UTC\r\nHome \u003e List all groups \u003e Planetary Reef\r\n Other threat group: Planetary Reef\r\nNames Planetary Reef (PhishLabs)\r\nCountry Indonesia\r\nMotivation Financial gain\r\nFirst seen 2020\r\nDescription\r\n(PhishLabs) PhishLabs is monitoring a threat actor group that has set up fraudulent hosting\r\ncompanies with leased IP space from a legitimate reseller. They are using this infrastructure for\r\nbulletproof hosting services as well as to carry out their own phishing attacks. The group,\r\nwhich is based in Indonesia, has been dubbed Planetary Reef.\r\nPlanetary Reef is most notable in how they host phishing sites. While traditional methods of\r\ndistributing phishing attacks rely on compromised websites or increasingly, free domains,\r\nPlanetary Reef is leasing their IP space from a large reseller. Using space, the group has\r\ncreated an array of seemingly legitimate hosting companies that they promote through social\r\nmedia.\r\nObserved\r\nTools used\r\nInformation\r\n\u003chttps://info.phishlabs.com/blog/planetary-reef-cybercriminal-hosting-and-phishing-as-a-service-threat-actor\u003e\r\nLast change to this card: 05 January 2021\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=17bfecf4-f046-4f3b-90c6-045eb4f6a436\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=17bfecf4-f046-4f3b-90c6-045eb4f6a436\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=17bfecf4-f046-4f3b-90c6-045eb4f6a436"
	],
	"report_names": [
		"showcard.cgi?u=17bfecf4-f046-4f3b-90c6-045eb4f6a436"
	],
	"threat_actors": [
		{
			"id": "11020e74-ad04-403e-b56d-e17e90df4809",
			"created_at": "2022-10-25T16:07:24.540076Z",
			"updated_at": "2026-04-10T02:00:05.026194Z",
			"deleted_at": null,
			"main_name": "Planetary Reef",
			"aliases": [],
			"source_name": "ETDA:Planetary Reef",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434636,
	"ts_updated_at": 1775826789,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/40761402946a1717409d9d330f5ca63d0038697a.pdf",
		"text": "https://archive.orkl.eu/40761402946a1717409d9d330f5ca63d0038697a.txt",
		"img": "https://archive.orkl.eu/40761402946a1717409d9d330f5ca63d0038697a.jpg"
	}
}