{
	"id": "d1d1a933-e788-4d80-b397-dfe739b2d3d5",
	"created_at": "2026-04-06T00:11:24.759632Z",
	"updated_at": "2026-04-10T03:29:45.243916Z",
	"deleted_at": null,
	"sha1_hash": "4982096573a0768f0c89a50e1eb9e1442bf24328",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 57884,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 18:03:42 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool FANNY\n Tool: FANNY\nNames\nFANNY\nDEMENTIAWHEEL\nCategory Malware\nType Reconnaissance, Downloader, Worm\nDescription\n(Kaspersky) A computer worm created in 2008 and used to gather information about targets in\nthe Middle East and Asia. Some victims appear to have been upgraded first to\nDOUBLEFANTASY, and then to the EQUATIONDRUG system. Fanny used exploits for two\nzero-day vulnerabilities which were later discovered with Stuxnet.\nInformation\nMalpedia Last change to this tool card: 28 December 2022\nDownload this tool card in JSON format\nAll groups using tool FANNY\nChanged Name Country Observed\nAPT groups\n Equation Group 2001-Aug 2016\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3666874f-3416-4132-b6b5-afd31a1dec44\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3666874f-3416-4132-b6b5-afd31a1dec44\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3666874f-3416-4132-b6b5-afd31a1dec44"
	],
	"report_names": [
		"listgroups.cgi?u=3666874f-3416-4132-b6b5-afd31a1dec44"
	],
	"threat_actors": [
		{
			"id": "b740943a-da51-4133-855b-df29822531ea",
			"created_at": "2022-10-25T15:50:23.604126Z",
			"updated_at": "2026-04-10T02:00:05.259593Z",
			"deleted_at": null,
			"main_name": "Equation",
			"aliases": [
				"Equation"
			],
			"source_name": "MITRE:Equation",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "08623296-52be-4977-8622-50efda44e9cc",
			"created_at": "2023-01-06T13:46:38.549387Z",
			"updated_at": "2026-04-10T02:00:03.020003Z",
			"deleted_at": null,
			"main_name": "Equation Group",
			"aliases": [
				"Tilded Team",
				"EQGRP",
				"G0020"
			],
			"source_name": "MISPGALAXY:Equation Group",
			"tools": [
				"TripleFantasy",
				"GrayFish",
				"EquationLaser",
				"EquationDrug",
				"DoubleFantasy"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2d9fbbd7-e4c3-40e5-b751-27af27c8610b",
			"created_at": "2024-05-01T02:03:08.144214Z",
			"updated_at": "2026-04-10T02:00:03.674763Z",
			"deleted_at": null,
			"main_name": "PLATINUM COLONY",
			"aliases": [
				"Equation Group "
			],
			"source_name": "Secureworks:PLATINUM COLONY",
			"tools": [
				"DoubleFantasy",
				"EquationDrug",
				"EquationLaser",
				"Fanny",
				"GrayFish",
				"TripleFantasy"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "e0fed6e6-a593-4041-80ef-694261825937",
			"created_at": "2022-10-25T16:07:23.593572Z",
			"updated_at": "2026-04-10T02:00:04.680752Z",
			"deleted_at": null,
			"main_name": "Equation Group",
			"aliases": [
				"APT-C-40",
				"G0020",
				"Platinum Colony",
				"Tilded Team"
			],
			"source_name": "ETDA:Equation Group",
			"tools": [
				"Bvp47",
				"DEMENTIAWHEEL",
				"DOUBLEFANTASY",
				"DanderSpritz",
				"DarkPulsar",
				"DoubleFantasy",
				"DoubleFeature",
				"DoublePulsar",
				"Duqu",
				"EQUATIONDRUG",
				"EQUATIONLASER",
				"EQUESTRE",
				"Flamer",
				"GRAYFISH",
				"GROK",
				"OddJob",
				"Plexor",
				"Prax",
				"Regin",
				"Skywiper",
				"TRIPLEFANTASY",
				"Tilded",
				"UNITEDRAKE",
				"WarriorPride",
				"sKyWIper"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434284,
	"ts_updated_at": 1775791785,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4982096573a0768f0c89a50e1eb9e1442bf24328.pdf",
		"text": "https://archive.orkl.eu/4982096573a0768f0c89a50e1eb9e1442bf24328.txt",
		"img": "https://archive.orkl.eu/4982096573a0768f0c89a50e1eb9e1442bf24328.jpg"
	}
}