{
	"id": "b805ce3b-0b28-4d02-b198-0fc17feca824",
	"created_at": "2026-04-06T00:15:46.534885Z",
	"updated_at": "2026-04-10T13:11:18.268693Z",
	"deleted_at": null,
	"sha1_hash": "64663d1fce090f61685a6a1da1914bced41f6602",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45200,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 17:32:03 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool CronBot\r\n Tool: CronBot\r\nNames CronBot\r\nCategory Malware\r\nType Banking trojan, Credential stealer\r\nDescription\r\n(The Hacker News) Once victims downloaded and installed these fake apps on their\r\ndevices, the apps added itself to the auto-start and the malware hidden inside them granted\r\nthe hackers the ability to phish victims' banking credentials and intercept SMS messages\r\ncontaining confirmation codes sent by the bank to verify the transactions.\r\nInformation \u003chttps://thehackernews.com/2017/05/cron-mobile-banking-malware.html\u003e\r\nAlienVault OTX \u003chttps://otx.alienvault.com/browse/pulses?q=tag:CronBot\u003e\r\nLast change to this tool card: 21 May 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool CronBot\r\nChanged Name Country Observed\r\nOther groups\r\n  Cron 2015-Dec 2017\r\n1 group listed (0 APT, 1 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4241f520-2de3-4e62-8a0f-51f04a119ca4\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4241f520-2de3-4e62-8a0f-51f04a119ca4\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4241f520-2de3-4e62-8a0f-51f04a119ca4"
	],
	"report_names": [
		"listgroups.cgi?u=4241f520-2de3-4e62-8a0f-51f04a119ca4"
	],
	"threat_actors": [
		{
			"id": "eb3f4e4d-2573-494d-9739-1be5141cf7b2",
			"created_at": "2022-10-25T16:07:24.471018Z",
			"updated_at": "2026-04-10T02:00:05.002374Z",
			"deleted_at": null,
			"main_name": "Cron",
			"aliases": [],
			"source_name": "ETDA:Cron",
			"tools": [
				"Catelites",
				"Catelites Bot",
				"CronBot",
				"TinyZBot"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434546,
	"ts_updated_at": 1775826678,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/64663d1fce090f61685a6a1da1914bced41f6602.pdf",
		"text": "https://archive.orkl.eu/64663d1fce090f61685a6a1da1914bced41f6602.txt",
		"img": "https://archive.orkl.eu/64663d1fce090f61685a6a1da1914bced41f6602.jpg"
	}
}