{
	"id": "42522149-6b62-4f9a-9c2d-8b3e7e19c932",
	"created_at": "2026-04-06T00:13:25.888566Z",
	"updated_at": "2026-04-10T03:34:59.363407Z",
	"deleted_at": null,
	"sha1_hash": "4cac0ea772fac653a6dda110dc08d6a5f38c1e1f",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43914,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 15:12:08 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool SmsSpy\n Tool: SmsSpy\nNames SmsSpy\nCategory Malware\nType Backdoor, Downloader\nDescription\n(McAfee) The malicious code infects Android users using one of two variants depending on\nthe version of OS used by the targeted devices. This ability to download malicious payloads\nbased on OS versions enables the attackers to successfully infect a much broader potential\nlandscape of Android devices.\nInformation\nMalpedia Last change to this tool card: 28 December 2021\nDownload this tool card in JSON format\nAll groups using tool SmsSpy\nChanged Name Country Observed\nOther groups\n Roaming Mantis [Unknown] 2017-Jul 2022\n1 group listed (0 APT, 1 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=17225d6e-bbdb-4a8d-aa14-0e615a27a8f9\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=17225d6e-bbdb-4a8d-aa14-0e615a27a8f9\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=17225d6e-bbdb-4a8d-aa14-0e615a27a8f9"
	],
	"report_names": [
		"listgroups.cgi?u=17225d6e-bbdb-4a8d-aa14-0e615a27a8f9"
	],
	"threat_actors": [
		{
			"id": "c94cb0e9-6fa9-47e9-a286-c9c9c9b23f4a",
			"created_at": "2023-01-06T13:46:38.823793Z",
			"updated_at": "2026-04-10T02:00:03.113045Z",
			"deleted_at": null,
			"main_name": "Roaming Mantis",
			"aliases": [
				"Roaming Mantis Group"
			],
			"source_name": "MISPGALAXY:Roaming Mantis",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f9bc28d0-ce98-4991-84ae-5036e5f9d4e3",
			"created_at": "2022-10-25T16:07:24.546437Z",
			"updated_at": "2026-04-10T02:00:05.029564Z",
			"deleted_at": null,
			"main_name": "Roaming Mantis",
			"aliases": [
				"Roaming Mantis Group",
				"Shaoye"
			],
			"source_name": "ETDA:Roaming Mantis",
			"tools": [
				"MoqHao",
				"Roaming Mantis",
				"SmsSpy",
				"Wroba",
				"XLoader"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434405,
	"ts_updated_at": 1775792099,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4cac0ea772fac653a6dda110dc08d6a5f38c1e1f.pdf",
		"text": "https://archive.orkl.eu/4cac0ea772fac653a6dda110dc08d6a5f38c1e1f.txt",
		"img": "https://archive.orkl.eu/4cac0ea772fac653a6dda110dc08d6a5f38c1e1f.jpg"
	}
}