{
	"id": "bd1e0b49-b83e-4afb-ac7d-c9a5abc62d72",
	"created_at": "2026-04-06T03:36:10.870675Z",
	"updated_at": "2026-04-10T03:26:39.090279Z",
	"deleted_at": null,
	"sha1_hash": "802d7d1ef1bcffbb8452baf7fbe8021be3e70865",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48710,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 03:14:41 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool ViperRAT\n Tool: ViperRAT\nNames\nViperRAT\nViper RAT\nCategory Malware\nType Backdoor, Info stealer, Exfiltration\nDescription\n(Lookout) ViperRAT is an active, advanced persistent threat (APT) that sophisticated\nthreat actors are actively using to target and spy on the Israeli Defense Force.\nInformation\nMITRE ATT\u0026CK Malpedia AlienVault OTX Last change to this tool card: 30 December 2022\nDownload this tool card in JSON format\nAll groups using tool ViperRAT\nChanged Name Country Observed\nAPT groups\n Desert Falcons [Gaza] 2011-Oct 2023\n1 group listed (1 APT, 0 other, 0 unknown)\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d85829da-432f-406b-9cb7-b6d94dc2db87\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d85829da-432f-406b-9cb7-b6d94dc2db87\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d85829da-432f-406b-9cb7-b6d94dc2db87\r\nPage 2 of 2\n\nAPT groups Desert Falcons [Gaza] 2011-Oct 2023\n1 group listed (1 APT, 0 other, 0 unknown) \n   Page 1 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=d85829da-432f-406b-9cb7-b6d94dc2db87"
	],
	"report_names": [
		"listgroups.cgi?u=d85829da-432f-406b-9cb7-b6d94dc2db87"
	],
	"threat_actors": [
		{
			"id": "9ff60d4d-153b-4ed5-a2f7-18a21d2fa05d",
			"created_at": "2022-10-25T16:07:23.539852Z",
			"updated_at": "2026-04-10T02:00:04.647734Z",
			"deleted_at": null,
			"main_name": "Desert Falcons",
			"aliases": [
				"APT-C-23",
				"ATK 66",
				"Arid Viper",
				"Niobium",
				"Operation Arid Viper",
				"Operation Bearded Barbie",
				"Operation Rebound",
				"Pinstripe Lightning",
				"Renegade Jackal",
				"TAG-63",
				"TAG-CT1",
				"Two-tailed Scorpion"
			],
			"source_name": "ETDA:Desert Falcons",
			"tools": [
				"AridSpy",
				"Barb(ie) Downloader",
				"BarbWire",
				"Desert Scorpion",
				"FrozenCell",
				"GlanceLove",
				"GnatSpy",
				"KasperAgent",
				"Micropsia",
				"PyMICROPSIA",
				"SpyC23",
				"Viper RAT",
				"ViperRAT",
				"VolatileVenom",
				"WinkChat",
				"android.micropsia"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775446570,
	"ts_updated_at": 1775791599,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/802d7d1ef1bcffbb8452baf7fbe8021be3e70865.pdf",
		"text": "https://archive.orkl.eu/802d7d1ef1bcffbb8452baf7fbe8021be3e70865.txt",
		"img": "https://archive.orkl.eu/802d7d1ef1bcffbb8452baf7fbe8021be3e70865.jpg"
	}
}