{
	"id": "ed18a05c-608b-4c27-a37b-3bd834d5129d",
	"created_at": "2026-04-06T00:21:57.080915Z",
	"updated_at": "2026-04-10T13:12:08.432992Z",
	"deleted_at": null,
	"sha1_hash": "65b5d831dca8e4e397d7e21ae55ed3fbdc1f79fd",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 53176,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 13:57:10 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Enfal\n Tool: Enfal\nNames\nEnfal\nLurid\nCategory Malware\nType Downloader\nDescription\n(Trend Micro) The Lurid Downloader, often referred to as Enfal, is a well-known\nmalware family. It is, however, not created with a publicly available toolkit that can be\npurchased by any aspiring cybercriminal. This malware family has, in the past, been\nused to target both the U.S. government and nongovernmental organizations (NGOs).\nHowever, there appear to be no direct links between this particular network and previous\nones.\nInformation\nMITRE ATT\u0026CK Malpedia AlienVault OTX Last change to this tool card: 13 May 2020\nDownload this tool card in JSON format\nAll groups using tool Enfal\nChanged Name Country Observed\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3f7ba2f1-b299-4601-8965-6ccf900ebdde\nPage 1 of 2\n\nAPT groups\r\n  PittyTiger, Pitty Panda 2011-2014  \r\n  Vicious Panda 2015-Mar 2020  \r\n2 groups listed (2 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3f7ba2f1-b299-4601-8965-6ccf900ebdde\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3f7ba2f1-b299-4601-8965-6ccf900ebdde\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3f7ba2f1-b299-4601-8965-6ccf900ebdde"
	],
	"report_names": [
		"listgroups.cgi?u=3f7ba2f1-b299-4601-8965-6ccf900ebdde"
	],
	"threat_actors": [
		{
			"id": "1b77c737-ab1f-45e9-ae50-996741d94ab2",
			"created_at": "2022-10-25T15:50:23.842907Z",
			"updated_at": "2026-04-10T02:00:05.401907Z",
			"deleted_at": null,
			"main_name": "PittyTiger",
			"aliases": [
				"PittyTiger"
			],
			"source_name": "MITRE:PittyTiger",
			"tools": [
				"gh0st RAT",
				"Lurid",
				"gsecdump",
				"PoisonIvy",
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6241b9be-9c59-4164-a7f2-c45844b14a56",
			"created_at": "2023-01-06T13:46:38.321506Z",
			"updated_at": "2026-04-10T02:00:02.926657Z",
			"deleted_at": null,
			"main_name": "APT24",
			"aliases": [
				"PITTY PANDA",
				"G0011",
				"Temp.Pittytiger"
			],
			"source_name": "MISPGALAXY:APT24",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f5c5d5d4-3969-4e34-9982-55144c3908eb",
			"created_at": "2022-10-25T16:07:24.37846Z",
			"updated_at": "2026-04-10T02:00:04.965506Z",
			"deleted_at": null,
			"main_name": "Vicious Panda",
			"aliases": [
				"Bronze Dudley"
			],
			"source_name": "ETDA:Vicious Panda",
			"tools": [
				"8.t Dropper",
				"8.t RTF exploit builder",
				"8t_dropper",
				"BBSRAT",
				"Byeby",
				"Cmstar",
				"Enfal",
				"Lurid",
				"Pylot",
				"RoyalRoad",
				"Travle",
				"meciv"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "6e79c98d-c678-4f28-b869-5723a78e71f4",
			"created_at": "2023-01-06T13:46:39.422441Z",
			"updated_at": "2026-04-10T02:00:03.322083Z",
			"deleted_at": null,
			"main_name": "Vicious Panda",
			"aliases": [
				"SixLittleMonkeys"
			],
			"source_name": "MISPGALAXY:Vicious Panda",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c2ef6b18-12c4-4879-a408-be4c9b03eb6e",
			"created_at": "2022-10-25T16:07:24.055115Z",
			"updated_at": "2026-04-10T02:00:04.852387Z",
			"deleted_at": null,
			"main_name": "PittyTiger",
			"aliases": [
				"G0011",
				"Operation The Eye of the Tiger",
				"Pitty Panda",
				"PittyTiger"
			],
			"source_name": "ETDA:PittyTiger",
			"tools": [
				"AngryRebel",
				"Chymine",
				"Darkmoon",
				"Enfal",
				"Farfli",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"Leo RAT",
				"Lurid",
				"Mimikatz",
				"Moudour",
				"Mydoor",
				"PCRat",
				"Paladin",
				"Paladin RAT",
				"Pitty",
				"PittyTiger RAT",
				"Poison Ivy",
				"ReRol",
				"SPIVY",
				"gsecdump",
				"pgift",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "20b5fa2f-2ef1-4e69-8275-25927a762f72",
			"created_at": "2025-08-07T02:03:24.573647Z",
			"updated_at": "2026-04-10T02:00:03.765721Z",
			"deleted_at": null,
			"main_name": "BRONZE DUDLEY",
			"aliases": [
				"TA428 ",
				"Temp.Hex ",
				"Vicious Panda "
			],
			"source_name": "Secureworks:BRONZE DUDLEY",
			"tools": [
				"NCCTrojan",
				"PhantomNet",
				"PoisonIvy",
				"Royal Road"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "7c8cf02c-623a-4793-918b-f908675a1aef",
			"created_at": "2023-01-06T13:46:38.309165Z",
			"updated_at": "2026-04-10T02:00:02.921721Z",
			"deleted_at": null,
			"main_name": "APT15",
			"aliases": [
				"Metushy",
				"Lurid",
				"Social Network Team",
				"Royal APT",
				"BRONZE DAVENPORT",
				"BRONZE IDLEWOOD",
				"VIXEN PANDA",
				"Ke3Chang",
				"Playful Dragon",
				"BRONZE PALACE",
				"G0004",
				"Red Vulture",
				"Nylon Typhoon"
			],
			"source_name": "MISPGALAXY:APT15",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434917,
	"ts_updated_at": 1775826728,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/65b5d831dca8e4e397d7e21ae55ed3fbdc1f79fd.pdf",
		"text": "https://archive.orkl.eu/65b5d831dca8e4e397d7e21ae55ed3fbdc1f79fd.txt",
		"img": "https://archive.orkl.eu/65b5d831dca8e4e397d7e21ae55ed3fbdc1f79fd.jpg"
	}
}