{
	"id": "3a495eb9-8caf-4425-ba3c-6232d9212863",
	"created_at": "2026-04-06T00:17:36.809987Z",
	"updated_at": "2026-04-10T03:30:14.87722Z",
	"deleted_at": null,
	"sha1_hash": "844f269dfb81184a3627100ae1a985467208c5f3",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43530,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 15:00:59 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool OperaPassView\r\n Tool: OperaPassView\r\nNames OperaPassView\r\nCategory Tools\r\nType Credential stealer\r\nDescription\r\nOperaPassView is a small password recovery tool that decrypts the content of the Opera Web\r\nbrowser password file (wand.dat) and displays the list of all Web site passwords stored in this\r\nfile. You can easily select one or more passwords in the OperaPassView window, and then\r\ncopy the passwords list to the clipboard and save it into text/html/csv/xml file.\r\nInformation \u003chttps://www.nirsoft.net/utils/opera_password_recovery.html\u003e\r\nLast change to this tool card: 19 October 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool OperaPassView\r\nChanged Name Country Observed\r\nAPT groups\r\n  XDSpy [Unknown] 2011-Jul 2024  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b3accb35-5e27-4d36-9408-b9efbb69617b\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b3accb35-5e27-4d36-9408-b9efbb69617b\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b3accb35-5e27-4d36-9408-b9efbb69617b"
	],
	"report_names": [
		"listgroups.cgi?u=b3accb35-5e27-4d36-9408-b9efbb69617b"
	],
	"threat_actors": [
		{
			"id": "69cba9ab-de35-4103-a699-7d243bcfd196",
			"created_at": "2023-01-06T13:46:39.159472Z",
			"updated_at": "2026-04-10T02:00:03.233731Z",
			"deleted_at": null,
			"main_name": "XDSpy",
			"aliases": [],
			"source_name": "MISPGALAXY:XDSpy",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d69b3831-de95-42c9-b4b6-26232627206f",
			"created_at": "2022-10-25T16:07:24.429466Z",
			"updated_at": "2026-04-10T02:00:04.985102Z",
			"deleted_at": null,
			"main_name": "XDSpy",
			"aliases": [],
			"source_name": "ETDA:XDSpy",
			"tools": [
				"ChromePass",
				"IE PassView",
				"MailPassView",
				"Network Password Recovery",
				"OperaPassView",
				"PasswordFox",
				"Protected Storage PassView",
				"XDDown",
				"XDList",
				"XDLoc",
				"XDMonitor",
				"XDPass",
				"XDRecon",
				"XDUpload"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434656,
	"ts_updated_at": 1775791814,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/844f269dfb81184a3627100ae1a985467208c5f3.pdf",
		"text": "https://archive.orkl.eu/844f269dfb81184a3627100ae1a985467208c5f3.txt",
		"img": "https://archive.orkl.eu/844f269dfb81184a3627100ae1a985467208c5f3.jpg"
	}
}