{
	"id": "22dfbcce-c089-447f-86b6-e0d48694ac28",
	"created_at": "2026-04-06T00:21:44.836279Z",
	"updated_at": "2026-04-10T03:31:13.12904Z",
	"deleted_at": null,
	"sha1_hash": "839514115a9d9e491d9a0877b34805ea6cea5c57",
	"title": "Cain \u0026 Abel - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 49082,
	"plain_text": "Cain \u0026 Abel - Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 13:58:49 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Cain \u0026 Abel\r\n Tool: Cain \u0026 Abel\r\nNames Cain \u0026 Abel\r\nCategory Tools\r\nType Credential stealer\r\nDescription\r\n(Wikipedia) Cain and Abel (often abbreviated to Cain) is a password recovery tool for\r\nMicrosoft Windows. It can recover many kinds of passwords using methods such as network\r\npacket sniffing, cracking various password hashes by using methods such as dictionary\r\nattacks, brute force and cryptanalysis attacks. Cryptanalysis attacks are done via rainbow\r\ntables which can be generated with the winrtgen.exe program provided with Cain and Abel.\r\nCain and Abel is maintained by Massimiliano Montoro and Sean Babcock.\r\nInformation \u003chttps://en.wikipedia.org/wiki/Cain_and_Abel_(software)\u003e\r\nLast change to this tool card: 20 April 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool Cain \u0026 Abel\r\nChanged Name Country Observed\r\nAPT groups\r\n  Carbanak, Anunak 2013-Apr 2023\r\n  Night Dragon 2009  \r\n2 groups listed (2 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=21826cc2-7a75-472b-8f14-6a775456a8a2\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=21826cc2-7a75-472b-8f14-6a775456a8a2\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=21826cc2-7a75-472b-8f14-6a775456a8a2"
	],
	"report_names": [
		"listgroups.cgi?u=21826cc2-7a75-472b-8f14-6a775456a8a2"
	],
	"threat_actors": [
		{
			"id": "ea844ee6-eb12-42c0-8426-11395fe81e6f",
			"created_at": "2022-10-25T15:50:23.300796Z",
			"updated_at": "2026-04-10T02:00:05.32389Z",
			"deleted_at": null,
			"main_name": "Night Dragon",
			"aliases": [
				"Night Dragon"
			],
			"source_name": "MITRE:Night Dragon",
			"tools": [
				"at",
				"gsecdump",
				"zwShell",
				"PsExec",
				"ASPXSpy",
				"gh0st RAT"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "c9617bb6-45c8-495e-9759-2177e61a8e91",
			"created_at": "2022-10-25T15:50:23.405039Z",
			"updated_at": "2026-04-10T02:00:05.387643Z",
			"deleted_at": null,
			"main_name": "Carbanak",
			"aliases": [
				"Carbanak",
				"Anunak"
			],
			"source_name": "MITRE:Carbanak",
			"tools": [
				"Carbanak",
				"Mimikatz",
				"PsExec",
				"netsh"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "09a8f8fe-e907-47b4-8709-a97717dde3cc",
			"created_at": "2022-10-25T16:07:23.90252Z",
			"updated_at": "2026-04-10T02:00:04.783553Z",
			"deleted_at": null,
			"main_name": "Night Dragon",
			"aliases": [
				"G0014"
			],
			"source_name": "ETDA:Night Dragon",
			"tools": [
				"ASPXSpy",
				"ASPXTool",
				"Cain \u0026 Abel",
				"gsecdump",
				"zwShell"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "9de1979b-40fc-44dc-855d-193edda4f3b8",
			"created_at": "2025-08-07T02:03:24.92723Z",
			"updated_at": "2026-04-10T02:00:03.755516Z",
			"deleted_at": null,
			"main_name": "GOLD LOCUST",
			"aliases": [
				"Anunak",
				"Carbanak",
				"Carbon Spider ",
				"FIN7 ",
				"Silicon "
			],
			"source_name": "Secureworks:GOLD LOCUST",
			"tools": [
				"Carbanak"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "020794ec-7315-47de-818c-2032c362fd15",
			"created_at": "2023-01-06T13:46:38.306576Z",
			"updated_at": "2026-04-10T02:00:02.920647Z",
			"deleted_at": null,
			"main_name": "Night Dragon",
			"aliases": [
				"G0014"
			],
			"source_name": "MISPGALAXY:Night Dragon",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "bb8702c5-52ac-4359-8409-998a7cc3eeaf",
			"created_at": "2023-01-06T13:46:38.405479Z",
			"updated_at": "2026-04-10T02:00:02.961112Z",
			"deleted_at": null,
			"main_name": "FIN7",
			"aliases": [
				"ATK32",
				"G0046",
				"G0008",
				"Sangria Tempest",
				"ELBRUS",
				"GOLD NIAGARA",
				"Coreid",
				"Carbanak",
				"Carbon Spider",
				"JokerStash",
				"CARBON SPIDER"
			],
			"source_name": "MISPGALAXY:FIN7",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "ed3810b7-141a-4ed0-8a01-6a972b80458d",
			"created_at": "2022-10-25T16:07:23.443259Z",
			"updated_at": "2026-04-10T02:00:04.602946Z",
			"deleted_at": null,
			"main_name": "Carbanak",
			"aliases": [
				"Anunak",
				"Carbanak",
				"Carbon Spider",
				"ELBRUS",
				"G0008",
				"Gold Waterfall",
				"Sangria Tempest"
			],
			"source_name": "ETDA:Carbanak",
			"tools": [
				"AVE_MARIA",
				"Agentemis",
				"AmmyyRAT",
				"Antak",
				"Anunak",
				"Ave Maria",
				"AveMariaRAT",
				"BABYMETAL",
				"BIRDDOG",
				"Backdoor Batel",
				"Batel",
				"Bateleur",
				"BlackMatter",
				"Boostwrite",
				"Cain \u0026 Abel",
				"Carbanak",
				"Cl0p",
				"Cobalt Strike",
				"CobaltStrike",
				"DNSMessenger",
				"DNSRat",
				"DNSbot",
				"DRIFTPIN",
				"DarkSide",
				"FOXGRABBER",
				"FlawedAmmyy",
				"HALFBAKED",
				"JS Flash",
				"KLRD",
				"MBR Eraser",
				"Mimikatz",
				"Nadrac",
				"Odinaff",
				"POWERPIPE",
				"POWERSOURCE",
				"PsExec",
				"SQLRAT",
				"Sekur",
				"Sekur RAT",
				"SocksBot",
				"SoftPerfect Network Scanner",
				"Spy.Agent.ORM",
				"TEXTMATE",
				"TeamViewer",
				"TiniMet",
				"TinyMet",
				"Toshliph",
				"VB Flash",
				"WARPRISM",
				"avemaria",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "f4f16213-7a22-4527-aecb-b964c64c2c46",
			"created_at": "2024-06-19T02:03:08.090932Z",
			"updated_at": "2026-04-10T02:00:03.6289Z",
			"deleted_at": null,
			"main_name": "GOLD NIAGARA",
			"aliases": [
				"Calcium ",
				"Carbanak",
				"Carbon Spider ",
				"FIN7 ",
				"Navigator ",
				"Sangria Tempest ",
				"TelePort Crew "
			],
			"source_name": "Secureworks:GOLD NIAGARA",
			"tools": [
				"Bateleur",
				"Carbanak",
				"Cobalt Strike",
				"DICELOADER",
				"DRIFTPIN",
				"GGLDR",
				"GRIFFON",
				"JSSLoader",
				"Meterpreter",
				"OFFTRACK",
				"PILLOWMINT",
				"POWERTRASH",
				"SUPERSOFT",
				"TAKEOUT",
				"TinyMet"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434904,
	"ts_updated_at": 1775791873,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/839514115a9d9e491d9a0877b34805ea6cea5c57.pdf",
		"text": "https://archive.orkl.eu/839514115a9d9e491d9a0877b34805ea6cea5c57.txt",
		"img": "https://archive.orkl.eu/839514115a9d9e491d9a0877b34805ea6cea5c57.jpg"
	}
}