{
	"id": "510cc245-85fc-4ecf-9376-76f66004409f",
	"created_at": "2026-04-06T00:06:40.273184Z",
	"updated_at": "2026-04-10T03:36:19.138045Z",
	"deleted_at": null,
	"sha1_hash": "69290a9091dbeeb75a54b1a6f099dbf09ab1338a",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48985,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 22:39:02 UTC\r\nHome \u003e List all groups \u003e Infraud Organization\r\n Other threat group: Infraud Organization\r\nNames Infraud Organization (real name)\r\nCountry [Various]\r\nMotivation Financial crime, Financial gain\r\nFirst seen 2010\r\nDescription\r\n(Bank Info Security) The Infraud Organization ran an online forum dedicated to\r\ncriminal activity that federal prosecutors claim had more than 10,000 members in\r\nMarch 2017. The site used the slogan 'In Fraud We Trust,' according to the Justice\r\nDepartment.\r\nThe gang that operated Infraud engaged in a variety of identity theft and financial fraud\r\nfrom October 2010 to February 2018, prosecutors say. It's believed to be responsible for\r\nthe sale or purchase of over 4 million compromised payment card numbers during that\r\ntime, according to the court filing. The aim of the organization was to develop the\r\n'premier online destination for the purchase and sale of stolen property and other\r\ncontraband' that also serves as the source of other contraband vendors, according to the\r\nJustice Department.\r\nThe gang used advertising to direct web traffic from its website to other automated sites\r\nthat were owned or operated by its members, helping other cybercriminals traffic in\r\npoint-of-sale malware, banking Trojans, stolen payment card details and counterfeit\r\nidentification, prosecutors say.\r\nObserved Countries: Worldwide.\r\nTools used FastPOS.\r\nCounter operations\r\nFeb 2018\r\nOperation “Shadow Web”\r\nThirty-six Defendants Indicted for Alleged Roles in Transnational\r\nCriminal Organization Responsible for More than $530 Million in\r\nLosses from Cybercrimes\r\n\u003chttps://www.justice.gov/opa/pr/thirty-six-defendants-indicted-alleged-roles-transnational-criminal-organization-responsible\u003e\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=8dce2769-0cce-4166-a15b-872c64250170\r\nPage 1 of 2\n\nJun 2020\r\nRussian National Pleads Guilty for Role in Transnational Cybercrime\r\nOrganization Responsible for more than $568 Million in Losses\r\n\u003chttps://www.justice.gov/opa/pr/russian-national-pleads-guilty-role-transnational-cybercrime-organization-responsible-more\u003e\r\nJul 2020\r\nMalware Author Pleads Guilty for Role in Transnational Cybercrime\r\nOrganization Responsible for more than $568 Million in Losses\r\n\u003chttps://www.justice.gov/opa/pr/malware-author-pleads-guilty-role-transnational-cybercrime-organization-responsible-more-568\u003e\r\nInformation\r\n\u003chttps://www.bankinfosecurity.com/fastpos-malware-creator-pleads-guilty-to-federal-charges-a-14751\u003e\r\n\u003chttps://en.wikipedia.org/wiki/Infraud_Organization\u003e\r\nLast change to this card: 02 August 2020\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=8dce2769-0cce-4166-a15b-872c64250170\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=8dce2769-0cce-4166-a15b-872c64250170\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=8dce2769-0cce-4166-a15b-872c64250170"
	],
	"report_names": [
		"showcard.cgi?u=8dce2769-0cce-4166-a15b-872c64250170"
	],
	"threat_actors": [
		{
			"id": "43cfcac9-ab2f-4f7d-ad3b-b2c09fb672b5",
			"created_at": "2022-10-25T16:07:24.499018Z",
			"updated_at": "2026-04-10T02:00:05.012584Z",
			"deleted_at": null,
			"main_name": "Infraud Organization",
			"aliases": [
				"Operation Shadow Web"
			],
			"source_name": "ETDA:Infraud Organization",
			"tools": [
				"FastPOS"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434000,
	"ts_updated_at": 1775792179,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/69290a9091dbeeb75a54b1a6f099dbf09ab1338a.pdf",
		"text": "https://archive.orkl.eu/69290a9091dbeeb75a54b1a6f099dbf09ab1338a.txt",
		"img": "https://archive.orkl.eu/69290a9091dbeeb75a54b1a6f099dbf09ab1338a.jpg"
	}
}