{
	"id": "f304bb55-fdec-4858-a53b-bb9f64eb294b",
	"created_at": "2026-04-06T00:06:34.815703Z",
	"updated_at": "2026-04-10T03:37:50.408756Z",
	"deleted_at": null,
	"sha1_hash": "412e2ab48ff4479282d0f887d7db4ab0f926e0e8",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51512,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 16:53:31 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool SMBExec\r\n Tool: SMBExec\r\nNames SMBExec\r\nCategory Tools\r\nType Remote command\r\nDescription A rapid PsExec style attack with samba tools.\r\nInformation \u003chttps://github.com/brav0hax/smbexec\u003e\r\nLast change to this tool card: 20 April 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool SMBExec\r\nChanged Name Country Observed\r\nAPT groups\r\n  APT 20, Violin Panda 2014-2017  \r\n  LightBasin 2016  \r\n  Operation Harvest 2016  \r\n  PowerPool [Unknown] 2018  \r\n  Sofacy, APT 28, Fancy Bear, Sednit 2004-Apr 2025\r\n5 groups listed (5 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=bfeddc8f-e09f-477c-b413-28410b596c32\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=bfeddc8f-e09f-477c-b413-28410b596c32\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=bfeddc8f-e09f-477c-b413-28410b596c32"
	],
	"report_names": [
		"listgroups.cgi?u=bfeddc8f-e09f-477c-b413-28410b596c32"
	],
	"threat_actors": [
		{
			"id": "62985c5c-6938-4365-8432-29573e99ecf4",
			"created_at": "2022-10-25T16:07:24.075092Z",
			"updated_at": "2026-04-10T02:00:04.859737Z",
			"deleted_at": null,
			"main_name": "PowerPool",
			"aliases": [],
			"source_name": "ETDA:PowerPool",
			"tools": [
				"ALPC Local PrivEsc",
				"FireMaster",
				"PowerDump",
				"PowerSploit",
				"Quarks PwDump",
				"SMBExec"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "5d512e7c-f6a7-47b5-b440-4968c299deaf",
			"created_at": "2023-01-06T13:46:38.344772Z",
			"updated_at": "2026-04-10T02:00:02.9359Z",
			"deleted_at": null,
			"main_name": "APT20",
			"aliases": [
				"VIOLIN PANDA",
				"TH3Bug",
				"Crawling Taurus"
			],
			"source_name": "MISPGALAXY:APT20",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "adee5dfb-98d1-488f-969d-48eed28cd7e4",
			"created_at": "2023-01-06T13:46:38.799427Z",
			"updated_at": "2026-04-10T02:00:03.105089Z",
			"deleted_at": null,
			"main_name": "PowerPool",
			"aliases": [
				"IAmTheKing"
			],
			"source_name": "MISPGALAXY:PowerPool",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "dd583696-3de6-4c23-bfb6-e675a38a7000",
			"created_at": "2022-10-25T16:07:23.338398Z",
			"updated_at": "2026-04-10T02:00:04.548798Z",
			"deleted_at": null,
			"main_name": "APT 20",
			"aliases": [
				"APT 20",
				"APT 8",
				"Crawling Taurus",
				"Operation Wocao",
				"TH3Bug",
				"Violin Panda"
			],
			"source_name": "ETDA:APT 20",
			"tools": [
				"Agent.dhwf",
				"Chymine",
				"Darkmoon",
				"Destroy RAT",
				"DestroyRAT",
				"Filesnfer",
				"Gen:Trojan.Heur.PT",
				"Kaba",
				"KeeThief",
				"Kerberoast",
				"Korplug",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Mimikatz",
				"PlugX",
				"Poison Ivy",
				"ProcDump",
				"PsExec",
				"RedDelta",
				"SMBExec",
				"SPIVY",
				"SharpHound",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"WinRAR",
				"XServer",
				"Xamtrav",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "ece64b74-f887-4d58-9004-2d1406d37337",
			"created_at": "2022-10-25T16:07:23.794442Z",
			"updated_at": "2026-04-10T02:00:04.751764Z",
			"deleted_at": null,
			"main_name": "LightBasin",
			"aliases": [
				"DecisiveArchitect",
				"Luminal Panda",
				"TH-239",
				"UNC1945"
			],
			"source_name": "ETDA:LightBasin",
			"tools": [
				"CordScan",
				"EVILSUN",
				"FRP",
				"Fast Reverse Proxy",
				"Impacket",
				"LEMONSTICK",
				"LOGBLEACH",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"OKSOLO",
				"OPENSHACKLE",
				"ProxyChains",
				"Pupy",
				"PupyRAT",
				"SIGTRANslator",
				"SLAPSTICK",
				"SMBExec",
				"STEELCORGI",
				"Tiny SHell",
				"pupy",
				"tsh"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "730dfa6e-572d-473c-9267-ea1597d1a42b",
			"created_at": "2023-01-06T13:46:38.389985Z",
			"updated_at": "2026-04-10T02:00:02.954105Z",
			"deleted_at": null,
			"main_name": "APT28",
			"aliases": [
				"Pawn Storm",
				"ATK5",
				"Fighting Ursa",
				"Blue Athena",
				"TA422",
				"T-APT-12",
				"APT-C-20",
				"UAC-0001",
				"IRON TWILIGHT",
				"SIG40",
				"UAC-0028",
				"Sofacy",
				"BlueDelta",
				"Fancy Bear",
				"GruesomeLarch",
				"Group 74",
				"ITG05",
				"FROZENLAKE",
				"Forest Blizzard",
				"FANCY BEAR",
				"Sednit",
				"SNAKEMACKEREL",
				"Tsar Team",
				"TG-4127",
				"STRONTIUM",
				"Grizzly Steppe",
				"G0007"
			],
			"source_name": "MISPGALAXY:APT28",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "31c0d0e1-f793-4374-90aa-138ea1daea50",
			"created_at": "2023-11-30T02:00:07.29462Z",
			"updated_at": "2026-04-10T02:00:03.482987Z",
			"deleted_at": null,
			"main_name": "LightBasin",
			"aliases": [
				"UNC1945",
				"CL-CRI-0025"
			],
			"source_name": "MISPGALAXY:LightBasin",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "46b409af-b2ea-43b8-9223-e01d982e00ce",
			"created_at": "2022-10-25T16:07:23.966265Z",
			"updated_at": "2026-04-10T02:00:04.810937Z",
			"deleted_at": null,
			"main_name": "Operation Harvest",
			"aliases": [],
			"source_name": "ETDA:Operation Harvest",
			"tools": [
				"Agent.dhwf",
				"BadPotato",
				"BleDoor",
				"Destroy RAT",
				"DestroyRAT",
				"Impacket",
				"Kaba",
				"Korplug",
				"Mimikatz",
				"NBTscan",
				"PlugX",
				"ProcDump",
				"PsExec",
				"RbDoor",
				"RedDelta",
				"RibDoor",
				"RottenPotato",
				"SMBExec",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"WinRAR",
				"Winnti",
				"Xamtrav",
				"nbtscan"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e3767160-695d-4360-8b2e-d5274db3f7cd",
			"created_at": "2022-10-25T16:47:55.914348Z",
			"updated_at": "2026-04-10T02:00:03.610018Z",
			"deleted_at": null,
			"main_name": "IRON TWILIGHT",
			"aliases": [
				"APT28 ",
				"ATK5 ",
				"Blue Athena ",
				"BlueDelta ",
				"FROZENLAKE ",
				"Fancy Bear ",
				"Fighting Ursa ",
				"Forest Blizzard ",
				"GRAPHITE ",
				"Group 74 ",
				"PawnStorm ",
				"STRONTIUM ",
				"Sednit ",
				"Snakemackerel ",
				"Sofacy ",
				"TA422 ",
				"TG-4127 ",
				"Tsar Team ",
				"UAC-0001 "
			],
			"source_name": "Secureworks:IRON TWILIGHT",
			"tools": [
				"Downdelph",
				"EVILTOSS",
				"SEDUPLOADER",
				"SHARPFRONT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "ae320ed7-9a63-42ed-944b-44ada7313495",
			"created_at": "2022-10-25T15:50:23.671663Z",
			"updated_at": "2026-04-10T02:00:05.283292Z",
			"deleted_at": null,
			"main_name": "APT28",
			"aliases": [
				"APT28",
				"IRON TWILIGHT",
				"SNAKEMACKEREL",
				"Group 74",
				"Sednit",
				"Sofacy",
				"Pawn Storm",
				"Fancy Bear",
				"STRONTIUM",
				"Tsar Team",
				"Threat Group-4127",
				"TG-4127",
				"Forest Blizzard",
				"FROZENLAKE",
				"GruesomeLarch"
			],
			"source_name": "MITRE:APT28",
			"tools": [
				"Wevtutil",
				"certutil",
				"Forfiles",
				"DealersChoice",
				"Mimikatz",
				"ADVSTORESHELL",
				"Komplex",
				"HIDEDRV",
				"JHUHUGIT",
				"Koadic",
				"Winexe",
				"cipher.exe",
				"XTunnel",
				"Drovorub",
				"CORESHELL",
				"OLDBAIT",
				"Downdelph",
				"XAgentOSX",
				"USBStealer",
				"Zebrocy",
				"reGeorg",
				"Fysbis",
				"LoJax"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "d2516b8e-e74f-490d-8a15-43ad6763c7ab",
			"created_at": "2022-10-25T16:07:24.212584Z",
			"updated_at": "2026-04-10T02:00:04.900038Z",
			"deleted_at": null,
			"main_name": "Sofacy",
			"aliases": [
				"APT 28",
				"ATK 5",
				"Blue Athena",
				"BlueDelta",
				"FROZENLAKE",
				"Fancy Bear",
				"Fighting Ursa",
				"Forest Blizzard",
				"G0007",
				"Grey-Cloud",
				"Grizzly Steppe",
				"Group 74",
				"GruesomeLarch",
				"ITG05",
				"Iron Twilight",
				"Operation DealersChoice",
				"Operation Dear Joohn",
				"Operation Komplex",
				"Operation Pawn Storm",
				"Operation RoundPress",
				"Operation Russian Doll",
				"Operation Steal-It",
				"Pawn Storm",
				"SIG40",
				"Sednit",
				"Snakemackerel",
				"Sofacy",
				"Strontium",
				"T-APT-12",
				"TA422",
				"TAG-0700",
				"TAG-110",
				"TG-4127",
				"Tsar Team",
				"UAC-0028",
				"UAC-0063"
			],
			"source_name": "ETDA:Sofacy",
			"tools": [
				"ADVSTORESHELL",
				"AZZY",
				"Backdoor.SofacyX",
				"CHERRYSPY",
				"CORESHELL",
				"Carberp",
				"Computrace",
				"DealersChoice",
				"Delphacy",
				"Downdelph",
				"Downrage",
				"Drovorub",
				"EVILTOSS",
				"Foozer",
				"GAMEFISH",
				"GooseEgg",
				"Graphite",
				"HATVIBE",
				"HIDEDRV",
				"Headlace",
				"Impacket",
				"JHUHUGIT",
				"JKEYSKW",
				"Koadic",
				"Komplex",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"LoJack",
				"LoJax",
				"MASEPIE",
				"Mimikatz",
				"NETUI",
				"Nimcy",
				"OCEANMAP",
				"OLDBAIT",
				"PocoDown",
				"PocoDownloader",
				"Popr-d30",
				"ProcDump",
				"PythocyDbg",
				"SMBExec",
				"SOURFACE",
				"SPLM",
				"STEELHOOK",
				"Sasfis",
				"Sedkit",
				"Sednit",
				"Sedreco",
				"Seduploader",
				"Shunnael",
				"SkinnyBoy",
				"Sofacy",
				"SofacyCarberp",
				"SpiderLabs Responder",
				"Trojan.Shunnael",
				"Trojan.Sofacy",
				"USB Stealer",
				"USBStealer",
				"VPNFilter",
				"Win32/USBStealer",
				"WinIDS",
				"Winexe",
				"X-Agent",
				"X-Tunnel",
				"XAPS",
				"XTunnel",
				"Xagent",
				"Zebrocy",
				"Zekapab",
				"carberplike",
				"certutil",
				"certutil.exe",
				"fysbis",
				"webhp"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775433994,
	"ts_updated_at": 1775792270,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/412e2ab48ff4479282d0f887d7db4ab0f926e0e8.pdf",
		"text": "https://archive.orkl.eu/412e2ab48ff4479282d0f887d7db4ab0f926e0e8.txt",
		"img": "https://archive.orkl.eu/412e2ab48ff4479282d0f887d7db4ab0f926e0e8.jpg"
	}
}