{
	"id": "66a3ff12-c6c5-4239-87a5-424e8c7fb462",
	"created_at": "2026-04-06T03:36:01.975493Z",
	"updated_at": "2026-04-10T03:33:36.888854Z",
	"deleted_at": null,
	"sha1_hash": "7ea9a7a8ccee5fbe299f599418da482cc8255345",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48654,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 03:10:38 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool MyKLoadClient\n Tool: MyKLoadClient\nNames MyKLoadClient\nCategory Malware\nType Loader\nDescription\n(BleepingComputer) MyKLoadClient is a loader using SFX archives combined with DLL\nside-loading through an auxiliary launcher library signed by McAfee Inc. The launcher\nsupports commands that give the threat actors close control over the infection.\nInformation\nLast change to this tool card: 19 July 2022\nDownload this tool card in JSON format\nAll groups using tool MyKLoadClient\nChanged Name Country Observed\nAPT groups\n Space Pirates 2017-Nov 2024\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=813e8c9a-b653-44e2-bbf9-4502fd83dd25\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=813e8c9a-b653-44e2-bbf9-4502fd83dd25\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=813e8c9a-b653-44e2-bbf9-4502fd83dd25"
	],
	"report_names": [
		"listgroups.cgi?u=813e8c9a-b653-44e2-bbf9-4502fd83dd25"
	],
	"threat_actors": [
		{
			"id": "536ca49a-2666-4005-8a50-e552fc7e16ef",
			"created_at": "2023-11-21T02:00:07.375813Z",
			"updated_at": "2026-04-10T02:00:03.471967Z",
			"deleted_at": null,
			"main_name": "Webworm",
			"aliases": [
				"Space Pirates"
			],
			"source_name": "MISPGALAXY:Webworm",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "8e385d36-06a2-4294-b3d3-01fe8e9d95f4",
			"created_at": "2022-10-25T16:07:24.219051Z",
			"updated_at": "2026-04-10T02:00:04.902017Z",
			"deleted_at": null,
			"main_name": "Space Pirates",
			"aliases": [
				"Erudite Mogwai",
				"Webworm"
			],
			"source_name": "ETDA:Space Pirates",
			"tools": [
				"9002 RAT",
				"Agent.dhwf",
				"AngryRebel",
				"BH_A006",
				"Chymine",
				"Darkmoon",
				"Deed RAT",
				"Destroy RAT",
				"DestroyRAT",
				"Farfli",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"HOMEUNIX",
				"HidraQ",
				"Homux",
				"Hydraq",
				"Kaba",
				"Korplug",
				"McRAT",
				"MdmBot",
				"Moudour",
				"MyKLoadClient",
				"Mydoor",
				"PCRat",
				"PCShare",
				"POISONPLUG.SHADOW",
				"PlugX",
				"Poison Ivy",
				"RedDelta",
				"Roarur",
				"SPIVY",
				"ShadowPad Winnti",
				"SnappyBee",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trochilus RAT",
				"XShellGhost",
				"Xamtrav",
				"Zupdax",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775446561,
	"ts_updated_at": 1775792016,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7ea9a7a8ccee5fbe299f599418da482cc8255345.pdf",
		"text": "https://archive.orkl.eu/7ea9a7a8ccee5fbe299f599418da482cc8255345.txt",
		"img": "https://archive.orkl.eu/7ea9a7a8ccee5fbe299f599418da482cc8255345.jpg"
	}
}