{
	"id": "1c3b0842-abd0-4d62-bd85-591e5eb5f421",
	"created_at": "2026-04-06T01:28:58.36344Z",
	"updated_at": "2026-04-10T03:35:12.366843Z",
	"deleted_at": null,
	"sha1_hash": "740d3ab6e8e894f211cad8fed9af187c89357138",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45384,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-06 00:23:27 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool ATMSpitter\r\n Tool: ATMSpitter\r\nNames ATMSpitter\r\nCategory Malware\r\nType ATM malware\r\nDescription\r\nThe ATMSpitter family consists of command-line tools designed to control the cash dispenser\r\nof an ATM through function calls to either CSCWCNG.dll or MFSXFS.dll.\r\nBoth libraries are legitimate Windows drivers used to interact with the components of different\r\nATM models.\r\nInformation\r\n\u003chttps://quoscient.io/reports/QuoINT_INTBRI_New_ATMSpitter.pdf\u003e\r\n\u003chttps://quoscient.io/reports/QuoINT_INTBRI_ATMSpitter_v2.pdf\u003e\r\nMalpedia \u003chttps://malpedia.caad.fkie.fraunhofer.de/details/win.atmspitter\u003e\r\nLast change to this tool card: 23 April 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool ATMSpitter\r\nChanged Name Country Observed\r\nAPT groups\r\n  Cobalt Group 2016-Oct 2019\r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0bf2c15-80da-4779-af76-708f9d5764eb\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0bf2c15-80da-4779-af76-708f9d5764eb\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=e0bf2c15-80da-4779-af76-708f9d5764eb"
	],
	"report_names": [
		"listgroups.cgi?u=e0bf2c15-80da-4779-af76-708f9d5764eb"
	],
	"threat_actors": [
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2dfaa730-7079-494c-b2f0-3ff8f3598a51",
			"created_at": "2022-10-25T16:07:23.474746Z",
			"updated_at": "2026-04-10T02:00:04.623746Z",
			"deleted_at": null,
			"main_name": "Cobalt Group",
			"aliases": [
				"ATK 67",
				"Cobalt Gang",
				"Cobalt Spider",
				"G0080",
				"Gold Kingswood",
				"Mule Libra",
				"TAG-CR3"
			],
			"source_name": "ETDA:Cobalt Group",
			"tools": [
				"ATMRipper",
				"ATMSpitter",
				"Agentemis",
				"AmmyyRAT",
				"AtNow",
				"COOLPANTS",
				"CobInt",
				"Cobalt Strike",
				"CobaltStrike",
				"Cyst Downloader",
				"Fareit",
				"FlawedAmmyy",
				"Formbook",
				"Little Pig",
				"Metasploit Stager",
				"Mimikatz",
				"More_eggs",
				"NSIS",
				"Nullsoft Scriptable Install System",
				"Pony Loader",
				"Ripper ATM",
				"SDelete",
				"Siplog",
				"SoftPerfect Network Scanner",
				"SpicyOmelette",
				"Taurus Builder",
				"Taurus Builder Kit",
				"Taurus Loader",
				"Terra Loader",
				"ThreatKit",
				"VenomKit",
				"cobeacon",
				"win.xloader"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c11abba0-f5e8-4017-a4ee-acb1a7c8c242",
			"created_at": "2022-10-25T15:50:23.744036Z",
			"updated_at": "2026-04-10T02:00:05.294413Z",
			"deleted_at": null,
			"main_name": "Cobalt Group",
			"aliases": [
				"Cobalt Group",
				"GOLD KINGSWOOD",
				"Cobalt Gang",
				"Cobalt Spider"
			],
			"source_name": "MITRE:Cobalt Group",
			"tools": [
				"Mimikatz",
				"More_eggs",
				"SpicyOmelette",
				"SDelete",
				"Cobalt Strike",
				"PsExec"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775438938,
	"ts_updated_at": 1775792112,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/740d3ab6e8e894f211cad8fed9af187c89357138.pdf",
		"text": "https://archive.orkl.eu/740d3ab6e8e894f211cad8fed9af187c89357138.txt",
		"img": "https://archive.orkl.eu/740d3ab6e8e894f211cad8fed9af187c89357138.jpg"
	}
}