{
	"id": "9404fe42-4fb9-42fc-ace2-a47ba0967e64",
	"created_at": "2026-04-06T03:36:50.178452Z",
	"updated_at": "2026-04-10T03:29:08.349186Z",
	"deleted_at": null,
	"sha1_hash": "6a122a5d139de68dbcc571a557b146336a949967",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 40984,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 03:26:11 UTC\n APT group: Terbium\nNames Terbium (Microsoft)\nCountry [Unknown]\nMotivation Sabotage and destruction\nFirst seen 2012\nDescription\n(Microsoft) A few weeks ago, multiple organizations in the Middle East fell victim to targeted\nand destructive attacks that wiped data from computers, and in many cases rendering them\nunstable and unbootable. Destructive attacks like these have been observed repeatedly over the\nyears and the Windows Defender and Windows Defender Advanced Threat Protection Threat\nIntelligence teams are working on protection, detection, and response to these threats.\nMicrosoft Threat Intelligence identified similarities between this recent attack and previous\n2012 attacks against tens of thousands of computers belonging to organizations in the energy\nsector. Microsoft Threat Intelligence refers to the activity group behind these attacks as\nTerbium, following our internal practice of assigning rogue actors chemical element names.\nObserved Countries: Middle East.\nTools used Depriz.\nInformation\nLast change to this card: 14 April 2020\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1bf39f2e-9b29-47aa-8b36-fc3fe2a41cc4\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=1bf39f2e-9b29-47aa-8b36-fc3fe2a41cc4\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1bf39f2e-9b29-47aa-8b36-fc3fe2a41cc4"
	],
	"report_names": [
		"showcard.cgi?u=1bf39f2e-9b29-47aa-8b36-fc3fe2a41cc4"
	],
	"threat_actors": [
		{
			"id": "f5fb4dc1-5777-4021-b9c2-4866246e4d74",
			"created_at": "2022-10-25T16:07:24.323585Z",
			"updated_at": "2026-04-10T02:00:04.935102Z",
			"deleted_at": null,
			"main_name": "Terbium",
			"aliases": [],
			"source_name": "ETDA:Terbium",
			"tools": [
				"Depriz"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "fec1dd86-d929-4691-b9ca-f804fb22971b",
			"created_at": "2023-01-06T13:46:38.5052Z",
			"updated_at": "2026-04-10T02:00:03.004846Z",
			"deleted_at": null,
			"main_name": "TERBIUM",
			"aliases": [],
			"source_name": "MISPGALAXY:TERBIUM",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775446610,
	"ts_updated_at": 1775791748,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6a122a5d139de68dbcc571a557b146336a949967.pdf",
		"text": "https://archive.orkl.eu/6a122a5d139de68dbcc571a557b146336a949967.txt",
		"img": "https://archive.orkl.eu/6a122a5d139de68dbcc571a557b146336a949967.jpg"
	}
}