{
	"id": "5429012c-dc95-4344-883a-7e1b4a289189",
	"created_at": "2026-04-06T00:11:59.134081Z",
	"updated_at": "2026-04-10T13:12:46.324844Z",
	"deleted_at": null,
	"sha1_hash": "42b68979ebe0978983ab290272dbc62ea3e7a859",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 44455,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 20:41:46 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool JackalSteal\n Tool: JackalSteal\nNames JackalSteal\nCategory Malware\nType Info stealer, Exfiltration\nDescription\n(Kaspersky) JackalSteal is another implant usually deployed on a few compromised machines\nthat is used to find files of interest on the target’s system and exfiltrate them to the C2 server.\nThis tool can be used to monitor removable USB drives, remote shares, and all logical drives\nin the targeted system. The malware can work as a standard process or as a service. It cannot\nmaintain persistence, so it must be installed by another component.\nInformation Last change to this tool card: 21 June 2023\nDownload this tool card in JSON format\nAll groups using tool JackalSteal\nChanged Name Country Observed\nAPT groups\n GoldenJackal [Unknown] 2019-2022\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ef662f31-1298-45a0-ad9a-8c823c99edb1\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ef662f31-1298-45a0-ad9a-8c823c99edb1\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ef662f31-1298-45a0-ad9a-8c823c99edb1"
	],
	"report_names": [
		"listgroups.cgi?u=ef662f31-1298-45a0-ad9a-8c823c99edb1"
	],
	"threat_actors": [
		{
			"id": "a8356cf9-e9d6-4585-8ccf-d30d3efe142b",
			"created_at": "2023-06-23T02:04:34.262059Z",
			"updated_at": "2026-04-10T02:00:04.711064Z",
			"deleted_at": null,
			"main_name": "GoldenJackal",
			"aliases": [],
			"source_name": "ETDA:GoldenJackal",
			"tools": [
				"JackalControl",
				"JackalPerInfo",
				"JackalScreenWatcher",
				"JackalSteal",
				"JackalWorm"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "bacb81f4-18d1-4dcd-b277-65a9dac41b61",
			"created_at": "2023-11-04T02:00:07.680044Z",
			"updated_at": "2026-04-10T02:00:03.390891Z",
			"deleted_at": null,
			"main_name": "GoldenJackal",
			"aliases": [],
			"source_name": "MISPGALAXY:GoldenJackal",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434319,
	"ts_updated_at": 1775826766,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/42b68979ebe0978983ab290272dbc62ea3e7a859.pdf",
		"text": "https://archive.orkl.eu/42b68979ebe0978983ab290272dbc62ea3e7a859.txt",
		"img": "https://archive.orkl.eu/42b68979ebe0978983ab290272dbc62ea3e7a859.jpg"
	}
}