Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 16:19:49 UTC Home > List all groups > List all tools > List all groups using tool RUHAPPY Tool: RUHAPPY Names RUHAPPY Category Malware Type Wiper Description (FireEye) RUHAPPY is a destructive wiper tool seen on systems targeted by DOGCALL. It attempts to overwrite the MBR, causing the system not to boot. When victims' systems attempt to boot, the string 'Are you Happy?' is displayed. The malware is believed to be tied to the developers of DOGCALL and HAPPYWORK based on similar PDB paths in all three. Information Last change to this tool card: 23 April 2020 Download this tool card in JSON format All groups using tool RUHAPPY Changed Name Country Observed APT groups   Reaper, APT 37, Ricochet Chollima, ScarCruft 2012-Mar 2025 1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a8c7c15b-7003-4dc4-ad11-c174f1a62894 https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a8c7c15b-7003-4dc4-ad11-c174f1a62894 Page 1 of 1