{
	"id": "9583cbd1-896d-4da3-baa6-549720c6b68f",
	"created_at": "2026-04-06T00:12:40.193375Z",
	"updated_at": "2026-04-10T13:11:36.53918Z",
	"deleted_at": null,
	"sha1_hash": "83ea37a9f8a7ea0f24dcbb8e94d03e8e6a64b162",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 47413,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 15:31:18 UTC\n APT group: IAmTheKing\nNames IAmTheKing (Kaspersky)\nCountry Russia\nMotivation Information theft and espionage\nFirst seen 2018\nDescription\n(Kaspersky) On October 1, 2020, the DHS CISA agency released information about a malware\nfamily called SlothfulMedia, which they attribute to a sophisticated threat actor. We have been\ntracking this set of activity through our private reporting service, and we would like to provide\nthe community with additional context.\nIn June 2018, we published the first report on a new cluster of activities that we named\nIAmTheKing, based on malware strings discovered in a malware sample from an unknown\nfamily. Amusingly, other strings present inside of it invited “kapasiky antivirus” to “leave\n[them] alone”.\nObserved\nSectors: Defense, Education, Energy, Government.\nCountries: Malaysia, Russia, Ukraine.\nTools used\nJackOfHearts, KingOfHearts, LaZagne, Mimikatz, ProcDump, PsExec, QueenOfClubs,\nQueenOfHearts.\nInformation Last change to this card: 19 October 2020\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e29e1820-caf6-420b-b4ba-f33391e48cfb\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=e29e1820-caf6-420b-b4ba-f33391e48cfb\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e29e1820-caf6-420b-b4ba-f33391e48cfb"
	],
	"report_names": [
		"showcard.cgi?u=e29e1820-caf6-420b-b4ba-f33391e48cfb"
	],
	"threat_actors": [
		{
			"id": "3262c97f-3311-49f5-807c-bcea4d8c9924",
			"created_at": "2022-10-25T16:07:23.717772Z",
			"updated_at": "2026-04-10T02:00:04.725048Z",
			"deleted_at": null,
			"main_name": "IAmTheKing",
			"aliases": [],
			"source_name": "ETDA:IAmTheKing",
			"tools": [
				"JackOfHearts",
				"KingOfHearts",
				"LaZagne",
				"Mimikatz",
				"ProcDump",
				"PsExec",
				"QueenOfClubs",
				"QueenOfHearts",
				"SLOTHFULMEDIA",
				"SlothfulMedia"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "adee5dfb-98d1-488f-969d-48eed28cd7e4",
			"created_at": "2023-01-06T13:46:38.799427Z",
			"updated_at": "2026-04-10T02:00:03.105089Z",
			"deleted_at": null,
			"main_name": "PowerPool",
			"aliases": [
				"IAmTheKing"
			],
			"source_name": "MISPGALAXY:PowerPool",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434360,
	"ts_updated_at": 1775826696,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/83ea37a9f8a7ea0f24dcbb8e94d03e8e6a64b162.pdf",
		"text": "https://archive.orkl.eu/83ea37a9f8a7ea0f24dcbb8e94d03e8e6a64b162.txt",
		"img": "https://archive.orkl.eu/83ea37a9f8a7ea0f24dcbb8e94d03e8e6a64b162.jpg"
	}
}