{
	"id": "1524437f-cea3-4818-8616-7b4303897773",
	"created_at": "2026-04-06T00:11:08.320397Z",
	"updated_at": "2026-04-10T03:37:26.682782Z",
	"deleted_at": null,
	"sha1_hash": "6f65c7aea2ec0d6aa1f3004df8f859e3b09925d3",
	"title": "Zombie Spider - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 32498,
	"plain_text": "Zombie Spider - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 19:44:09 UTC\r\nDescription(CrowdStrike) The primary threat actor, who was tracked by CrowdStrike as Zombie Spider, rose to\r\nprominence in the criminal underground under the moniker Peter Severa. The individual behind this handle is\r\nPeter Yuryevich LEVASHOV who was arrested in Spain when the final version of Kelihos was taken over in April\r\n2017, and who recently pleaded guilty to operating the botnet for criminal purposes.\r\nFor several years, pump-and-dump stock scams, dating ruses, credential phishing, money mule recruitment and\r\nrogue online pharmacy advertisements were the most common spam themes. In 2017, however, Kelihos was\r\nfrequently used to spread other malware such as LuminosityLink, Zyklon HTTP, Neutrino, Nymaim, Gozi/ISFB,\r\nPanda Zeus, Kronos, and TrickBot. It was also observed spreading ransomware families including Shade, Cerber,\r\nand FileCrypt2.\r\nKelihos has been observed to distribute TrickBot (Wizard Spider, Gold Blackburn) and Zeus Panda (Bamboo\r\nSpider, TA544).\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2c1d1677-f2d9-44e1-ac9a-4f7f4047e2d5\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=2c1d1677-f2d9-44e1-ac9a-4f7f4047e2d5\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2c1d1677-f2d9-44e1-ac9a-4f7f4047e2d5"
	],
	"report_names": [
		"showcard.cgi?u=2c1d1677-f2d9-44e1-ac9a-4f7f4047e2d5"
	],
	"threat_actors": [
		{
			"id": "c91f7778-69aa-45fa-be0e-4ee33daf8fbd",
			"created_at": "2023-01-06T13:46:39.110148Z",
			"updated_at": "2026-04-10T02:00:03.216613Z",
			"deleted_at": null,
			"main_name": "NARWHAL SPIDER",
			"aliases": [
				"GOLD ESSEX",
				"TA544",
				"Storm-0302"
			],
			"source_name": "MISPGALAXY:NARWHAL SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "03a8107a-f669-41af-ba79-41b1cbdc4654",
			"created_at": "2023-01-06T13:46:39.228649Z",
			"updated_at": "2026-04-10T02:00:03.25247Z",
			"deleted_at": null,
			"main_name": "BAMBOO SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:BAMBOO SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f6f91e1c-9202-4497-bf22-9cd5ef477600",
			"created_at": "2023-01-06T13:46:38.86765Z",
			"updated_at": "2026-04-10T02:00:03.12735Z",
			"deleted_at": null,
			"main_name": "WIZARD SPIDER",
			"aliases": [
				"TEMP.MixMaster",
				"GOLD BLACKBURN",
				"DEV-0193",
				"UNC2053",
				"Pistachio Tempest",
				"DEV-0237",
				"Storm-0230",
				"FIN12",
				"Periwinkle Tempest",
				"Storm-0193",
				"Trickbot LLC"
			],
			"source_name": "MISPGALAXY:WIZARD SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e312df00-4c6f-44c3-b717-4b72800c7697",
			"created_at": "2023-01-06T13:46:39.03345Z",
			"updated_at": "2026-04-10T02:00:03.190159Z",
			"deleted_at": null,
			"main_name": "ZOMBIE SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:ZOMBIE SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "bc119938-a79c-4e5f-9d4d-dc96835dfe2e",
			"created_at": "2024-06-04T02:03:07.799286Z",
			"updated_at": "2026-04-10T02:00:03.606456Z",
			"deleted_at": null,
			"main_name": "GOLD BLACKBURN",
			"aliases": [
				"ITG23 ",
				"Periwinkle Tempest ",
				"Wizard Spider "
			],
			"source_name": "Secureworks:GOLD BLACKBURN",
			"tools": [
				"BazarLoader",
				"Buer Loader",
				"Bumblebee",
				"Dyre",
				"Team9",
				"TrickBot"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "956fc691-b6c6-4b09-b69d-8f007c189839",
			"created_at": "2025-08-07T02:03:24.860251Z",
			"updated_at": "2026-04-10T02:00:03.656547Z",
			"deleted_at": null,
			"main_name": "GOLD ESSEX",
			"aliases": [
				"Narwhal Spider ",
				"Storm-0302 ",
				"TA544 "
			],
			"source_name": "Secureworks:GOLD ESSEX",
			"tools": [
				"Cutwail",
				"Pony",
				"Pushdo"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "3c3ca3f2-9a6a-463e-869c-e9bf02d398d7",
			"created_at": "2022-10-25T16:07:24.59432Z",
			"updated_at": "2026-04-10T02:00:05.047762Z",
			"deleted_at": null,
			"main_name": "Zombie Spider",
			"aliases": [],
			"source_name": "ETDA:Zombie Spider",
			"tools": [
				"Hlux",
				"Kelihos",
				"Waledac"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "63061658-5810-4f01-9620-7eada7e9ae2e",
			"created_at": "2022-10-25T15:50:23.752974Z",
			"updated_at": "2026-04-10T02:00:05.244531Z",
			"deleted_at": null,
			"main_name": "Wizard Spider",
			"aliases": [
				"Wizard Spider",
				"UNC1878",
				"TEMP.MixMaster",
				"Grim Spider",
				"FIN12",
				"GOLD BLACKBURN",
				"ITG23",
				"Periwinkle Tempest",
				"DEV-0193"
			],
			"source_name": "MITRE:Wizard Spider",
			"tools": [
				"TrickBot",
				"AdFind",
				"BITSAdmin",
				"Bazar",
				"LaZagne",
				"Nltest",
				"GrimAgent",
				"Dyre",
				"Ryuk",
				"Conti",
				"Emotet",
				"Rubeus",
				"Mimikatz",
				"Diavol",
				"PsExec",
				"Cobalt Strike"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "e6a21528-2999-4e2e-aaf4-8b6af14e17f3",
			"created_at": "2022-10-25T16:07:24.422115Z",
			"updated_at": "2026-04-10T02:00:04.983298Z",
			"deleted_at": null,
			"main_name": "Wizard Spider",
			"aliases": [
				"DEV-0193",
				"G0102",
				"Gold Blackburn",
				"Gold Ulrick",
				"Grim Spider",
				"ITG23",
				"Operation BazaFlix",
				"Periwinkle Tempest",
				"Storm-0230",
				"TEMP.MixMaster",
				"Wizard Spider"
			],
			"source_name": "ETDA:Wizard Spider",
			"tools": [
				"AdFind",
				"Agentemis",
				"Anchor_DNS",
				"BEERBOT",
				"BazarBackdoor",
				"BazarCall",
				"BazarLoader",
				"Cobalt Strike",
				"CobaltStrike",
				"Conti",
				"Diavol",
				"Dyranges",
				"Dyre",
				"Dyreza",
				"Dyzap",
				"Gophe",
				"Invoke-SMBAutoBrute",
				"KEGTAP",
				"LaZagne",
				"LightBot",
				"PowerSploit",
				"PowerTrick",
				"PsExec",
				"Ryuk",
				"SessionGopher",
				"TSPY_TRICKLOAD",
				"Team9Backdoor",
				"The Trick",
				"TheTrick",
				"Totbrick",
				"TrickBot",
				"TrickLoader",
				"TrickMo",
				"Upatre",
				"bazaloader",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "1f679d2e-c5c9-49e9-b854-2eca06a870e4",
			"created_at": "2022-10-25T16:07:24.453427Z",
			"updated_at": "2026-04-10T02:00:04.997515Z",
			"deleted_at": null,
			"main_name": "Bamboo Spider",
			"aliases": [
				"Bamboo Spider",
				"TA544"
			],
			"source_name": "ETDA:Bamboo Spider",
			"tools": [
				"AndroKINS",
				"Bebloh",
				"Chthonic",
				"DELoader",
				"Dofoil",
				"GozNym",
				"Gozi ISFB",
				"ISFB",
				"Nymaim",
				"PandaBanker",
				"Pandemyia",
				"Sharik",
				"Shiotob",
				"Smoke Loader",
				"SmokeLoader",
				"Terdot",
				"URLZone",
				"XSphinx",
				"ZLoader",
				"Zeus OpenSSL",
				"Zeus Panda",
				"Zeus Sphinx",
				"ZeusPanda",
				"nymain"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434268,
	"ts_updated_at": 1775792246,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6f65c7aea2ec0d6aa1f3004df8f859e3b09925d3.pdf",
		"text": "https://archive.orkl.eu/6f65c7aea2ec0d6aa1f3004df8f859e3b09925d3.txt",
		"img": "https://archive.orkl.eu/6f65c7aea2ec0d6aa1f3004df8f859e3b09925d3.jpg"
	}
}