{
	"id": "a3e44f01-5a33-488f-9cbc-6cd0a4612901",
	"created_at": "2026-04-06T00:06:32.136667Z",
	"updated_at": "2026-04-10T03:35:27.529439Z",
	"deleted_at": null,
	"sha1_hash": "750a0438e43bd87a6db714f30c401f25811a5d25",
	"title": "Earth Minotaur - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46297,
	"plain_text": "Earth Minotaur - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-05 14:25:36 UTC\r\nHome \u003e List all groups \u003e Earth Minotaur\r\n APT group: Earth Minotaur\r\nNames Earth Minotaur (Trend Micro)\r\nCountry China\r\nMotivation Information theft and espionage\r\nFirst seen 2019\r\nDescription\r\n(Trend Micro) We believe that Earth Minotaur is an intrusion set which hasn’t been publicly\r\nreported. In the first report of MOONSHINE exploit kit in 2019, the threat actor using the\r\ntoolkit was named Poison Carp, Evil Eye. While both used the MOONSHINE exploit kit and\r\nhad similar targets, we did not find further connections between Earth Minotaur and POISON\r\nCARP. The backdoor DarkNimbus had been developed in 2018 but was not found in any of\r\nPOISON CARP’s previous activity. Therefore, we categorized them as two different intrusion\r\nsets.\r\nObserved Sectors: Tibetan and Uyghur activists as well as those who are interested in their causes.\r\nTools used DarkNimbus, MOONSHINE.\r\nInformation \u003chttps://www.trendmicro.com/en_us/research/24/l/earth-minotaur.html\u003e\r\nLast change to this card: 27 December 2024\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=7d5663d5-d239-4bc6-8532-0dfa5aa34363\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=7d5663d5-d239-4bc6-8532-0dfa5aa34363\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=7d5663d5-d239-4bc6-8532-0dfa5aa34363"
	],
	"report_names": [
		"showcard.cgi?u=7d5663d5-d239-4bc6-8532-0dfa5aa34363"
	],
	"threat_actors": [
		{
			"id": "f0ebaf6d-5e1a-4ed7-aa2c-0e69a648acea",
			"created_at": "2022-10-25T16:07:23.597455Z",
			"updated_at": "2026-04-10T02:00:04.683154Z",
			"deleted_at": null,
			"main_name": "Evil Eye",
			"aliases": [],
			"source_name": "ETDA:Evil Eye",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "52973e5f-9656-4b60-b7f8-457e32ac4bbe",
			"created_at": "2023-01-06T13:46:39.056888Z",
			"updated_at": "2026-04-10T02:00:03.198866Z",
			"deleted_at": null,
			"main_name": "POISON CARP",
			"aliases": [
				"Evil Eye",
				"Red Dev 16",
				"Earth Empusa"
			],
			"source_name": "MISPGALAXY:POISON CARP",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "dc813ffb-16bd-46f7-9d8f-8e93089f00c1",
			"created_at": "2024-12-28T02:01:54.748213Z",
			"updated_at": "2026-04-10T02:00:04.669444Z",
			"deleted_at": null,
			"main_name": "Earth Minotaur",
			"aliases": [],
			"source_name": "ETDA:Earth Minotaur",
			"tools": [
				"DarkNimbus",
				"MOONSHINE"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "d2a5c949-7ae0-4610-8bb8-047ab03b1574",
			"created_at": "2022-10-25T16:07:24.064197Z",
			"updated_at": "2026-04-10T02:00:04.856578Z",
			"deleted_at": null,
			"main_name": "Poison Carp",
			"aliases": [
				"Earth Empusa",
				"Evil Eye",
				"EvilBamboo",
				"Poison Carp",
				"Red Dev 16",
				"Sentinel Taurus"
			],
			"source_name": "ETDA:Poison Carp",
			"tools": [
				"ActionSpy",
				"AxeSpy",
				"BADSIGNAL",
				"BADSOLAR",
				"BadBazaar",
				"IRONSQUIRREL",
				"IceCube",
				"MOONSHINE",
				"PoisonCarp"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775433992,
	"ts_updated_at": 1775792127,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/750a0438e43bd87a6db714f30c401f25811a5d25.pdf",
		"text": "https://archive.orkl.eu/750a0438e43bd87a6db714f30c401f25811a5d25.txt",
		"img": "https://archive.orkl.eu/750a0438e43bd87a6db714f30c401f25811a5d25.jpg"
	}
}