{
	"id": "0fa298b2-dc25-43d3-9acc-cedf69760f0a",
	"created_at": "2026-04-06T00:08:27.250371Z",
	"updated_at": "2026-04-10T03:29:44.358307Z",
	"deleted_at": null,
	"sha1_hash": "45be92d871ea3419da1052bbe804ced7e2524edb",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45729,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 16:36:36 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool KOCTOPUS\n Tool: KOCTOPUS\nNames KOCTOPUS\nCategory Malware\nType Loader\nDescription\n(Malwarebytes) The actor has used this loader to load Octopus and Koadic and in some\ncases other RATs such as Luminosity RAT, RMS and QuasarRAT.\nInformation MITRE ATT\u0026CK Last change to this tool card: 30 December 2022\nDownload this tool card in JSON format\nAll groups using tool KOCTOPUS\nChanged Name Country Observed\nAPT groups\n LazyScripter [Unknown] 2018\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f82d1669-7a60-4dc0-b58a-8b3a78c17339\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f82d1669-7a60-4dc0-b58a-8b3a78c17339\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=f82d1669-7a60-4dc0-b58a-8b3a78c17339"
	],
	"report_names": [
		"listgroups.cgi?u=f82d1669-7a60-4dc0-b58a-8b3a78c17339"
	],
	"threat_actors": [
		{
			"id": "b20281dd-8cc4-4284-b85c-f98c7e09ae48",
			"created_at": "2022-10-25T15:50:23.642844Z",
			"updated_at": "2026-04-10T02:00:05.392724Z",
			"deleted_at": null,
			"main_name": "LazyScripter",
			"aliases": [
				"LazyScripter"
			],
			"source_name": "MITRE:LazyScripter",
			"tools": [
				"Remcos",
				"QuasarRAT",
				"njRAT",
				"ngrok",
				"Koadic",
				"KOCTOPUS"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "712fc9fa-4283-431b-882c-5e0de9c12452",
			"created_at": "2022-10-25T16:07:23.770209Z",
			"updated_at": "2026-04-10T02:00:04.745132Z",
			"deleted_at": null,
			"main_name": "LazyScripter",
			"aliases": [
				"G0140"
			],
			"source_name": "ETDA:LazyScripter",
			"tools": [
				"Adwind",
				"Adwind RAT",
				"Alien Spy",
				"AlienSpy",
				"Bladabindi",
				"CinaRAT",
				"EmPyre",
				"EmpireProject",
				"Empoder",
				"Frutas",
				"Gussdoor",
				"Invoke-Ngrok",
				"JBifrost RAT",
				"JSocket",
				"Jorik",
				"KOCTOPUS",
				"Koadic",
				"Luminosity RAT",
				"LuminosityLink",
				"Nishang",
				"PowerShell Empire",
				"Quasar RAT",
				"QuasarRAT",
				"Remcos",
				"RemcosRAT",
				"Remote Manipulator System",
				"Remvio",
				"RuRAT",
				"Sockrat",
				"Socmer",
				"Trojan.Maljava",
				"UnReCoM",
				"Unknown RAT",
				"Unrecom",
				"Yggdrasil",
				"jBiFrost",
				"jConnectPro RAT",
				"jFrutas",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434107,
	"ts_updated_at": 1775791784,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/45be92d871ea3419da1052bbe804ced7e2524edb.pdf",
		"text": "https://archive.orkl.eu/45be92d871ea3419da1052bbe804ced7e2524edb.txt",
		"img": "https://archive.orkl.eu/45be92d871ea3419da1052bbe804ced7e2524edb.jpg"
	}
}