{
	"id": "8cafaa41-6de7-4e91-bac2-87d7939cb416",
	"created_at": "2026-04-06T03:36:01.502877Z",
	"updated_at": "2026-04-10T03:31:17.803728Z",
	"deleted_at": null,
	"sha1_hash": "53b20e87750ffecc5ce5f35f492c42a3514e0850",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 56502,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 03:25:25 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool White Lambert\n Tool: White Lambert\nNames White Lambert\nCategory Malware\nType Backdoor\nDescription\n(Kaspersky) Looking for similar samples, we were able to identify another generation of\nrelated tools which we called White Lambert. While Black Lambert connects directly to its\nC\u0026C for instructions, White Lambert is a fully passive, network-driven backdoor.\nInformation Last change to this tool card: 20 April 2020\nDownload this tool card in JSON format\nAll groups using tool White Lambert\nChanged Name Country Observed\nAPT groups\n ↳ Subgroup: Longhorn, The Lamberts 2009\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ad12591d-7435-4a6b-a37f-ff7caff6336c\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ad12591d-7435-4a6b-a37f-ff7caff6336c\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=ad12591d-7435-4a6b-a37f-ff7caff6336c"
	],
	"report_names": [
		"listgroups.cgi?u=ad12591d-7435-4a6b-a37f-ff7caff6336c"
	],
	"threat_actors": [
		{
			"id": "e993faab-f941-4561-bd87-7c33d609a4fc",
			"created_at": "2022-10-25T16:07:23.460301Z",
			"updated_at": "2026-04-10T02:00:04.617715Z",
			"deleted_at": null,
			"main_name": "Longhorn",
			"aliases": [
				"APT-C-39",
				"Platinum Terminal",
				"The Lamberts"
			],
			"source_name": "ETDA:Longhorn",
			"tools": [
				"Black Lambert",
				"Blue Lambert",
				"Corentry",
				"Cyan Lambert",
				"Fluxwire",
				"Gray Lambert",
				"Green Lambert",
				"Magenta Lambert",
				"Pink Lambert",
				"Plexor",
				"Purple Lambert",
				"Silver Lambert",
				"Violet Lambert",
				"White Lambert"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "70db80bd-31b7-4581-accb-914cd8252913",
			"created_at": "2023-01-06T13:46:38.57727Z",
			"updated_at": "2026-04-10T02:00:03.028845Z",
			"deleted_at": null,
			"main_name": "Longhorn",
			"aliases": [
				"the Lamberts",
				"APT-C-39",
				"PLATINUM TERMINAL"
			],
			"source_name": "MISPGALAXY:Longhorn",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "23dfc9f5-1862-4510-a6ae-53d8e51f17b1",
			"created_at": "2024-05-01T02:03:08.146025Z",
			"updated_at": "2026-04-10T02:00:03.67072Z",
			"deleted_at": null,
			"main_name": "PLATINUM TERMINAL",
			"aliases": [
				"APT-C-39 ",
				"Longhorn ",
				"The Lamberts ",
				"Vault7 "
			],
			"source_name": "Secureworks:PLATINUM TERMINAL",
			"tools": [
				"AfterMidnight",
				"Assassin",
				"Marble Framework"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775446561,
	"ts_updated_at": 1775791877,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/53b20e87750ffecc5ce5f35f492c42a3514e0850.pdf",
		"text": "https://archive.orkl.eu/53b20e87750ffecc5ce5f35f492c42a3514e0850.txt",
		"img": "https://archive.orkl.eu/53b20e87750ffecc5ce5f35f492c42a3514e0850.jpg"
	}
}