{
	"id": "186aacc1-a261-4302-ad3f-24c9e1c89583",
	"created_at": "2026-04-06T01:30:55.844836Z",
	"updated_at": "2026-04-10T13:12:39.047644Z",
	"deleted_at": null,
	"sha1_hash": "4e089c678d8a6a2dc6557b0fb8f8c31a2d4350cd",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46233,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 00:49:43 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool PipeSnoop\n Tool: PipeSnoop\nNames\nPipeSnoop\nTOFUPIPE\nCategory Malware\nType Backdoor\nDescription\n(Talos) The PipeSnoop implant, created in May 2023, is a simple implant that can run arbitrary\nshellcode payloads on the infected endpoint by reading from an IPC pipe. Although\nsemantically similar, the PipeSnoop implant should not be considered an upgrade of\nHTTPSnoop. Both implants are likely designed to work under different environments. The\nHTTP URLs used by HTTPSnoop along with the binding to the built-in Windows web server\nindicate that it was likely designed to work on internet-exposed web and EWS servers.\nPipeSnoop, however, as the name may imply, reads and writes to and from a Windows IPC\npipe for its input/output (I/O) capabilities This suggests the implant is likely designed to\nfunction further within a compromised enterprise--instead of public-facing servers like\nHTTPSnoop — and probably is intended for use against endpoints the malware operators\ndeem more valuable or high-priority. PipeSnoop is likely used in conjunction with another\ncomponent that is capable of feeding it the required shellcode.\nInformation Malpedia Last change to this tool card: 27 December 2024\nDownload this tool card in JSON format\nAll groups using tool PipeSnoop\nChanged Name Country Observed\nAPT groups\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=62fa1276-485f-4d1e-a624-1782f8b63a0b\nPage 1 of 2\n\nShroudedSnooper [Unknown] 2023  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=62fa1276-485f-4d1e-a624-1782f8b63a0b\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=62fa1276-485f-4d1e-a624-1782f8b63a0b\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=62fa1276-485f-4d1e-a624-1782f8b63a0b"
	],
	"report_names": [
		"listgroups.cgi?u=62fa1276-485f-4d1e-a624-1782f8b63a0b"
	],
	"threat_actors": [
		{
			"id": "9d63303c-817c-40d7-b703-c6d62f0dbddc",
			"created_at": "2023-10-14T02:03:14.471787Z",
			"updated_at": "2026-04-10T02:00:04.891855Z",
			"deleted_at": null,
			"main_name": "ShroudedSnooper",
			"aliases": [],
			"source_name": "ETDA:ShroudedSnooper",
			"tools": [
				"HTTPSnoop",
				"PipeSnoop",
				"TOFULOAD",
				"TOFUPIPE"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "1ddad928-ad5f-4885-9abd-e8965dd793df",
			"created_at": "2023-11-08T02:00:07.129402Z",
			"updated_at": "2026-04-10T02:00:03.421623Z",
			"deleted_at": null,
			"main_name": "ShroudedSnooper",
			"aliases": [],
			"source_name": "MISPGALAXY:ShroudedSnooper",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775439055,
	"ts_updated_at": 1775826759,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4e089c678d8a6a2dc6557b0fb8f8c31a2d4350cd.pdf",
		"text": "https://archive.orkl.eu/4e089c678d8a6a2dc6557b0fb8f8c31a2d4350cd.txt",
		"img": "https://archive.orkl.eu/4e089c678d8a6a2dc6557b0fb8f8c31a2d4350cd.jpg"
	}
}