{
	"id": "a5e3c611-e024-4388-aaea-e3af2cb0d8e7",
	"created_at": "2026-04-06T00:14:15.813153Z",
	"updated_at": "2026-04-10T13:11:56.298286Z",
	"deleted_at": null,
	"sha1_hash": "521a3aaeb0aa691aad59b46627d158d313dc41ae",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46992,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 19:27:20 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool FighterPOS\n Tool: FighterPOS\nNames FighterPOS\nCategory Malware\nType POS malware, Keylogger, Credential stealer\nDescription\n(FireEye) The functionality of FighterPOS is similar to other PoS malware families we’ve\nseen in the past. It is capable of collecting credit card track 1, track 2, and CVV codes.\nThe malware also contains a RAM scraping functionality, commonly seen in many PoS\nmalware families. Additionally, its keylogger functionality allows the attacker to log all\nkeystrokes on the infected terminal. The code for the RAM scraping functionality is\nsimilar to that found in NewPosThings.\nInformation\nAlienVault OTX Last change to this tool card: 24 May 2020\nDownload this tool card in JSON format\nAll groups using tool FighterPOS\nChanged Name Country Observed\nUnknown groups\n _[ Interesting malware not linked to an actor yet ]_\n1 group listed (0 APT, 0 other, 1 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0c335fb3-efae-430c-80fa-85fd5ec41be4\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0c335fb3-efae-430c-80fa-85fd5ec41be4\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0c335fb3-efae-430c-80fa-85fd5ec41be4"
	],
	"report_names": [
		"listgroups.cgi?u=0c335fb3-efae-430c-80fa-85fd5ec41be4"
	],
	"threat_actors": [],
	"ts_created_at": 1775434455,
	"ts_updated_at": 1775826716,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/521a3aaeb0aa691aad59b46627d158d313dc41ae.pdf",
		"text": "https://archive.orkl.eu/521a3aaeb0aa691aad59b46627d158d313dc41ae.txt",
		"img": "https://archive.orkl.eu/521a3aaeb0aa691aad59b46627d158d313dc41ae.jpg"
	}
}