{
	"id": "33b37a76-b2af-4c33-9fb1-b0967c82ade4",
	"created_at": "2026-04-06T00:16:15.372799Z",
	"updated_at": "2026-04-10T03:36:50.179075Z",
	"deleted_at": null,
	"sha1_hash": "5d4ffe525f1fbe6a108b58195eb8d6f7bcf5d24f",
	"title": "Crimson RAT - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 54068,
	"plain_text": "Crimson RAT - Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 13:04:29 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Crimson RAT\n Tool: Crimson RAT\nNames\nCrimson RAT\nCrimson\nSEEDOOR\nScarimson\nMSIL\nMSIL/Crimson\nCategory Malware\nType Backdoor\nDescription\nCrimson is malware used as part of a campaign known as Operation Transparent Tribe\nthat targeted Indian diplomatic and military victims.\nInformation\nMITRE ATT\u0026CK Malpedia AlienVault OTX Last change to this tool card: 30 December 2022\nDownload this tool card in JSON format\nAll groups using tool Crimson RAT\nChanged Name Country Observed\nAPT groups\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=12f48fde-94b3-4bae-a6cd-90b31e77c31f\nPage 1 of 2\n\nGorgon Group 2017-Jul 2020  \r\n  Transparent Tribe, APT 36 2013-Mar 2025  \r\n2 groups listed (2 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=12f48fde-94b3-4bae-a6cd-90b31e77c31f\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=12f48fde-94b3-4bae-a6cd-90b31e77c31f\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=12f48fde-94b3-4bae-a6cd-90b31e77c31f"
	],
	"report_names": [
		"listgroups.cgi?u=12f48fde-94b3-4bae-a6cd-90b31e77c31f"
	],
	"threat_actors": [
		{
			"id": "414d7c65-5872-4e56-8a7d-49a2aeef1632",
			"created_at": "2025-08-07T02:03:24.7983Z",
			"updated_at": "2026-04-10T02:00:03.76109Z",
			"deleted_at": null,
			"main_name": "COPPER FIELDSTONE",
			"aliases": [
				"APT36 ",
				"Earth Karkaddan ",
				"Gorgon Group ",
				"Green Havildar ",
				"Mythic Leopard ",
				"Operation C-Major ",
				"Operation Transparent Tribe ",
				"Pasty Draco ",
				"ProjectM ",
				"Storm-0156 "
			],
			"source_name": "Secureworks:COPPER FIELDSTONE",
			"tools": [
				"CapraRAT",
				"Crimson RAT",
				"DarkComet",
				"ElizaRAT",
				"LuminosityLink",
				"ObliqueRAT",
				"Peppy",
				"njRAT"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "fce5181c-7aab-400f-bd03-9db9e791da04",
			"created_at": "2022-10-25T15:50:23.759799Z",
			"updated_at": "2026-04-10T02:00:05.3002Z",
			"deleted_at": null,
			"main_name": "Transparent Tribe",
			"aliases": [
				"Transparent Tribe",
				"COPPER FIELDSTONE",
				"APT36",
				"Mythic Leopard",
				"ProjectM"
			],
			"source_name": "MITRE:Transparent Tribe",
			"tools": [
				"DarkComet",
				"ObliqueRAT",
				"njRAT",
				"Peppy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "18278778-fa63-4a9a-8988-4d266b8c5c1a",
			"created_at": "2023-01-06T13:46:38.769816Z",
			"updated_at": "2026-04-10T02:00:03.094179Z",
			"deleted_at": null,
			"main_name": "The Gorgon Group",
			"aliases": [
				"Gorgon Group",
				"Subaat",
				"ATK92",
				"G0078",
				"Pasty Gemini"
			],
			"source_name": "MISPGALAXY:The Gorgon Group",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "97fdaf9f-cae1-4ccc-abe2-76e5cbc0febd",
			"created_at": "2022-10-25T15:50:23.296989Z",
			"updated_at": "2026-04-10T02:00:05.347085Z",
			"deleted_at": null,
			"main_name": "Gorgon Group",
			"aliases": [
				"Gorgon Group"
			],
			"source_name": "MITRE:Gorgon Group",
			"tools": [
				"NanoCore",
				"QuasarRAT",
				"Remcos",
				"njRAT"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6c4e4b91-1f98-49e2-90e6-435cea8d3d53",
			"created_at": "2022-10-25T16:07:23.693797Z",
			"updated_at": "2026-04-10T02:00:04.711987Z",
			"deleted_at": null,
			"main_name": "Gorgon Group",
			"aliases": [
				"ATK 92",
				"G0078",
				"Pasty Draco",
				"Subaat",
				"TAG-CR5"
			],
			"source_name": "ETDA:Gorgon Group",
			"tools": [
				"AgenTesla",
				"Agent Tesla",
				"AgentTesla",
				"Atros2.CKPN",
				"Bladabindi",
				"CinaRAT",
				"Crimson RAT",
				"ForeIT",
				"Jorik",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Loki",
				"Loki.Rat",
				"LokiBot",
				"LokiPWS",
				"MSIL",
				"MSIL/Crimson",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Negasteal",
				"NetWeird",
				"NetWire",
				"NetWire RAT",
				"NetWire RC",
				"NetWired RC",
				"Origin Logger",
				"Quasar RAT",
				"QuasarRAT",
				"Recam",
				"Remcos",
				"RemcosRAT",
				"Remvio",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"SEEDOOR",
				"Scarimson",
				"Socmer",
				"Yggdrasil",
				"ZPAQ",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "abb24b7b-6baa-4070-9a2b-aa59091097d1",
			"created_at": "2022-10-25T16:07:24.339942Z",
			"updated_at": "2026-04-10T02:00:04.944806Z",
			"deleted_at": null,
			"main_name": "Transparent Tribe",
			"aliases": [
				"APT 36",
				"APT-C-56",
				"Copper Fieldstone",
				"Earth Karkaddan",
				"G0134",
				"Green Havildar",
				"Mythic Leopard",
				"Opaque Draco",
				"Operation C-Major",
				"Operation Honey Trap",
				"Operation Transparent Tribe",
				"ProjectM",
				"STEPPY-KAVACH",
				"Storm-0156",
				"TEMP.Lapis",
				"Transparent Tribe"
			],
			"source_name": "ETDA:Transparent Tribe",
			"tools": [
				"Amphibeon",
				"Android RAT",
				"Bezigate",
				"Bladabindi",
				"Bozok",
				"Bozok RAT",
				"BreachRAT",
				"Breut",
				"CapraRAT",
				"CinaRAT",
				"Crimson RAT",
				"DarkComet",
				"DarkKomet",
				"ElizaRAT",
				"FYNLOS",
				"Fynloski",
				"Jorik",
				"Krademok",
				"Limepad",
				"Luminosity RAT",
				"LuminosityLink",
				"MSIL",
				"MSIL/Crimson",
				"Mobzsar",
				"MumbaiDown",
				"Oblique RAT",
				"ObliqueRAT",
				"Peppy RAT",
				"Peppy Trojan",
				"Quasar RAT",
				"QuasarRAT",
				"SEEDOOR",
				"Scarimson",
				"SilentCMD",
				"Stealth Mango",
				"UPDATESEE",
				"USBWorm",
				"Waizsar RAT",
				"Yggdrasil",
				"beendoor",
				"klovbot",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c68fa27f-e8d9-4932-856b-467ccfe39997",
			"created_at": "2023-01-06T13:46:38.450585Z",
			"updated_at": "2026-04-10T02:00:02.980334Z",
			"deleted_at": null,
			"main_name": "Operation C-Major",
			"aliases": [
				"APT36",
				"APT 36",
				"TMP.Lapis",
				"COPPER FIELDSTONE",
				"Storm-0156",
				"Transparent Tribe",
				"ProjectM",
				"Green Havildar",
				"Earth Karkaddan",
				"C-Major",
				"Mythic Leopard"
			],
			"source_name": "MISPGALAXY:Operation C-Major",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434575,
	"ts_updated_at": 1775792210,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/5d4ffe525f1fbe6a108b58195eb8d6f7bcf5d24f.pdf",
		"text": "https://archive.orkl.eu/5d4ffe525f1fbe6a108b58195eb8d6f7bcf5d24f.txt",
		"img": "https://archive.orkl.eu/5d4ffe525f1fbe6a108b58195eb8d6f7bcf5d24f.jpg"
	}
}