{
	"id": "e08d42a8-d34a-4ef8-b18c-ab8f509e55c0",
	"created_at": "2026-04-06T03:37:19.77817Z",
	"updated_at": "2026-04-10T03:33:41.867283Z",
	"deleted_at": null,
	"sha1_hash": "6614ca64cde6b7acf5cd0a12d00f7946a64fd479",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43752,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 03:13:20 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool WinSCP\n Tool: WinSCP\nNames WinSCP\nCategory Tools\nType Exfiltration\nDescription\nWinSCP is a popular SFTP client and FTP client for Microsoft Windows! Copy file between a\nlocal computer and remote servers using FTP, FTPS, SCP, SFTP, WebDAV or S3 file transfer\nprotocols.\nInformation Last change to this tool card: 15 June 2020\nDownload this tool card in JSON format\nAll groups using tool WinSCP\nChanged Name Country Observed\nAPT groups\n TA2101, Maze Team [Unknown] 2019-Feb 2024\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=efca5f08-6023-4b26-9f60-b9c1ded8fb9f\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=efca5f08-6023-4b26-9f60-b9c1ded8fb9f\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=efca5f08-6023-4b26-9f60-b9c1ded8fb9f"
	],
	"report_names": [
		"listgroups.cgi?u=efca5f08-6023-4b26-9f60-b9c1ded8fb9f"
	],
	"threat_actors": [
		{
			"id": "e9f85280-337c-4321-b872-0919f8ef64a6",
			"created_at": "2022-10-25T16:07:24.261761Z",
			"updated_at": "2026-04-10T02:00:04.914455Z",
			"deleted_at": null,
			"main_name": "TA2101",
			"aliases": [
				"Gold Village",
				"Maze Team",
				"TA2101",
				"Twisted Spider"
			],
			"source_name": "ETDA:TA2101",
			"tools": [
				"7-Zip",
				"Agentemis",
				"BokBot",
				"Buran",
				"ChaCha",
				"Cobalt Strike",
				"CobaltStrike",
				"Egregor",
				"IceID",
				"IcedID",
				"Mimikatz",
				"PsExec",
				"SharpHound",
				"VegaLocker",
				"WinSCP",
				"cobeacon",
				"nmap"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c3c864b3-fac9-4d56-8500-7c06c829fbf8",
			"created_at": "2023-01-06T13:46:39.071873Z",
			"updated_at": "2026-04-10T02:00:03.203749Z",
			"deleted_at": null,
			"main_name": "TA2101",
			"aliases": [
				"GOLD VILLAGE",
				"Storm-0216",
				"DEV-0216",
				"UNC2198",
				"TUNNEL SPIDER",
				"Maze Team",
				"TWISTED SPIDER"
			],
			"source_name": "MISPGALAXY:TA2101",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775446639,
	"ts_updated_at": 1775792021,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6614ca64cde6b7acf5cd0a12d00f7946a64fd479.pdf",
		"text": "https://archive.orkl.eu/6614ca64cde6b7acf5cd0a12d00f7946a64fd479.txt",
		"img": "https://archive.orkl.eu/6614ca64cde6b7acf5cd0a12d00f7946a64fd479.jpg"
	}
}