{
	"id": "3688fb96-bf69-40c5-ad60-82807a7c7ab6",
	"created_at": "2026-04-06T00:06:13.340421Z",
	"updated_at": "2026-04-10T03:33:51.320775Z",
	"deleted_at": null,
	"sha1_hash": "84a323855778ae8cb65e6fdcd8c6e17cc5ec0a77",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 64963,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 23:22:01 UTC\nHome \u003e List all groups \u003e DarkHydrus, LazyMeerkat\n APT group: DarkHydrus, LazyMeerkat\nNames\nDarkHydrus (Palo Alto)\nLazyMeerkat (Kaspersky)\nATK 77 (Thales)\nObscure Serpens (Palo Alto)\nG0079 (MITRE)\nCountry Iran\nSponsor State-sponsored\nMotivation Information theft and espionage\nFirst seen 2016\nDescription\nDarkHydrus is a threat group that has targeted government agencies and educational\ninstitutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloads for carrying out attacks.\nSome analysts track Dark Hydrus, APT 19, Deep Panda, C0d0so0 and Turbine\nPanda, APT 26, Shell Crew, WebMasters, KungFu Kittens as the same group, but it\nis unclear from open source information if the groups are the same.\nObserved\nSectors: Education, Government.\nCountries: Iran and Middle East.\nTools used Cobalt Strike, Mimikatz, Phishery, RogueRobin.\nOperations performed\nJun 2018\nOn June 24, 2018, Unit 42 observed DarkHydrus carrying out a\ncredential harvesting attack on an educational institution in the Middle\nEast. The attack involved a spear-phishing email with a subject of\n“Project Offer” and a malicious Word document as an attachment.\nJul 2018 Attack on Middle East Government\nThis attack diverged from previous attacks we observed from this group\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=2849cc26-d6c8-4484-821e-cb0f7006bddc\nPage 1 of 2\n\nas it involved spear-phishing emails sent to targeted organizations with\npassword protected RAR archive attachments that contained malicious\nExcel Web Query files (.iqy).\nJan 2019\nNew Attacks in the Middle East\n360 Threat Intelligence Center captured several lure Excel documents\nwritten in Arabic in January 9, 2019. A backdoor dropped by macro in\nthe lure documents can communicate with C2 server through DNS\ntunnel, as well as Google Drive API.\nInformation\nMITRE ATT\u0026CK Playbook Last change to this card: 16 August 2025\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2849cc26-d6c8-4484-821e-cb0f7006bddc\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=2849cc26-d6c8-4484-821e-cb0f7006bddc\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2849cc26-d6c8-4484-821e-cb0f7006bddc"
	],
	"report_names": [
		"showcard.cgi?u=2849cc26-d6c8-4484-821e-cb0f7006bddc"
	],
	"threat_actors": [
		{
			"id": "1f3cf3d1-4764-4158-a216-dd6352e671bb",
			"created_at": "2022-10-25T15:50:23.837615Z",
			"updated_at": "2026-04-10T02:00:05.322197Z",
			"deleted_at": null,
			"main_name": "APT19",
			"aliases": [
				"APT19",
				"Codoso",
				"C0d0so0",
				"Codoso Team",
				"Sunshop Group"
			],
			"source_name": "MITRE:APT19",
			"tools": [
				"Cobalt Strike"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "610a7295-3139-4f34-8cec-b3da40add480",
			"created_at": "2023-01-06T13:46:38.608142Z",
			"updated_at": "2026-04-10T02:00:03.03764Z",
			"deleted_at": null,
			"main_name": "Cobalt",
			"aliases": [
				"Cobalt Group",
				"Cobalt Gang",
				"GOLD KINGSWOOD",
				"COBALT SPIDER",
				"G0080",
				"Mule Libra"
			],
			"source_name": "MISPGALAXY:Cobalt",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "3fad11c6-4336-4b28-a606-f510eca5452e",
			"created_at": "2022-10-25T16:07:24.346573Z",
			"updated_at": "2026-04-10T02:00:04.948823Z",
			"deleted_at": null,
			"main_name": "Turbine Panda",
			"aliases": [
				"APT 26",
				"Black Vine",
				"Bronze Express",
				"Group 13",
				"JerseyMikes",
				"KungFu Kittens",
				"PinkPanther",
				"Shell Crew",
				"Taffeta Typhoon",
				"Turbine Panda",
				"WebMasters"
			],
			"source_name": "ETDA:Turbine Panda",
			"tools": [
				"Agent.dhwf",
				"Agentemis",
				"BleDoor",
				"Cobalt Strike",
				"CobaltStrike",
				"Derusbi",
				"Destroy RAT",
				"DestroyRAT",
				"FF-RAT",
				"FormerFirstRAT",
				"Hurix",
				"Kaba",
				"Korplug",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Mivast",
				"PlugX",
				"RbDoor",
				"RedDelta",
				"RibDoor",
				"Sakula",
				"Sakula RAT",
				"Sakurel",
				"Sogu",
				"StreamEx",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Winnti",
				"Xamtrav",
				"cobeacon",
				"ffrat"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "a080173e-7141-4d46-831d-a5f15ebef31a",
			"created_at": "2023-01-06T13:46:38.629955Z",
			"updated_at": "2026-04-10T02:00:03.044597Z",
			"deleted_at": null,
			"main_name": "APT26",
			"aliases": [
				"JerseyMikes",
				"TURBINE PANDA",
				"BRONZE EXPRESS",
				"TECHNETIUM",
				"Taffeta Typhoon"
			],
			"source_name": "MISPGALAXY:APT26",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "64ca1755-3883-4173-8e0a-6e5cf92faafd",
			"created_at": "2022-10-25T15:50:23.636456Z",
			"updated_at": "2026-04-10T02:00:05.389234Z",
			"deleted_at": null,
			"main_name": "Deep Panda",
			"aliases": [
				"Deep Panda",
				"Shell Crew",
				"KungFu Kittens",
				"PinkPanther",
				"Black Vine"
			],
			"source_name": "MITRE:Deep Panda",
			"tools": [
				"Mivast",
				"StreamEx",
				"Sakula",
				"Tasklist",
				"Derusbi"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6efb28db-4d91-46cb-8ab7-fe9e8449ccfc",
			"created_at": "2023-01-06T13:46:38.772861Z",
			"updated_at": "2026-04-10T02:00:03.095095Z",
			"deleted_at": null,
			"main_name": "DarkHydrus",
			"aliases": [
				"LazyMeerkat",
				"G0079",
				"Obscure Serpens"
			],
			"source_name": "MISPGALAXY:DarkHydrus",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "0639667a-fb3f-43d9-a38c-6c123fd19c7f",
			"created_at": "2022-10-25T16:07:23.335869Z",
			"updated_at": "2026-04-10T02:00:04.547702Z",
			"deleted_at": null,
			"main_name": "APT 19",
			"aliases": [
				"APT 19",
				"Bronze Firestone",
				"C0d0so0",
				"Checkered Typhoon",
				"Codoso",
				"Deep Panda",
				"G0009",
				"G0073",
				"Operation Kingslayer",
				"Red Pegasus",
				"Sunshop Group",
				"TG-3551"
			],
			"source_name": "ETDA:APT 19",
			"tools": [
				"Agentemis",
				"C0d0so0",
				"Cobalt Strike",
				"CobaltStrike",
				"Derusbi",
				"EmPyre",
				"EmpireProject",
				"Fire Chili",
				"PowerShell Empire",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "5b04780e-7b64-4e62-b776-c6749ff7dec8",
			"created_at": "2022-10-25T16:07:23.531741Z",
			"updated_at": "2026-04-10T02:00:04.643562Z",
			"deleted_at": null,
			"main_name": "DarkHydrus",
			"aliases": [
				"ATK 77",
				"DarkHydrus",
				"G0079",
				"LazyMeerkat",
				"Obscure Serpens"
			],
			"source_name": "ETDA:DarkHydrus",
			"tools": [
				"Agentemis",
				"Cobalt Strike",
				"CobaltStrike",
				"Mimikatz",
				"Phishery",
				"RogueRobin",
				"RogueRobinNET",
				"Trojan.Phisherly",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "46a151bd-e4c2-46f9-aee9-ee6942b01098",
			"created_at": "2023-01-06T13:46:38.288168Z",
			"updated_at": "2026-04-10T02:00:02.911919Z",
			"deleted_at": null,
			"main_name": "APT19",
			"aliases": [
				"DEEP PANDA",
				"Codoso",
				"KungFu Kittens",
				"Group 13",
				"G0009",
				"G0073",
				"Checkered Typhoon",
				"Black Vine",
				"TEMP.Avengers",
				"PinkPanther",
				"Shell Crew",
				"BRONZE FIRESTONE",
				"Sunshop Group"
			],
			"source_name": "MISPGALAXY:APT19",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f2ce5b52-a220-4b94-ab66-4b81f3fed05d",
			"created_at": "2025-08-07T02:03:24.595597Z",
			"updated_at": "2026-04-10T02:00:03.740023Z",
			"deleted_at": null,
			"main_name": "BRONZE FIRESTONE",
			"aliases": [
				"APT19 ",
				"C0d0s0",
				"Checkered Typhoon ",
				"Chlorine ",
				"Deep Panda ",
				"Pupa ",
				"TG-3551 "
			],
			"source_name": "Secureworks:BRONZE FIRESTONE",
			"tools": [
				"9002",
				"Alice's Rabbit Hole",
				"Cobalt Strike",
				"Derusbi",
				"PlugX",
				"PoisonIvy",
				"PowerShell Empire",
				"Trojan Briba",
				"Zuguo"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "4fe925e8-95e5-4a63-9f96-4d0f9bedac08",
			"created_at": "2022-10-25T15:50:23.469077Z",
			"updated_at": "2026-04-10T02:00:05.384299Z",
			"deleted_at": null,
			"main_name": "DarkHydrus",
			"aliases": [
				"DarkHydrus"
			],
			"source_name": "MITRE:DarkHydrus",
			"tools": [
				"Mimikatz",
				"RogueRobin",
				"Cobalt Strike"
			],
			"source_id": "MITRE",
			"reports": null
		}
	],
	"ts_created_at": 1775433973,
	"ts_updated_at": 1775792031,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/84a323855778ae8cb65e6fdcd8c6e17cc5ec0a77.pdf",
		"text": "https://archive.orkl.eu/84a323855778ae8cb65e6fdcd8c6e17cc5ec0a77.txt",
		"img": "https://archive.orkl.eu/84a323855778ae8cb65e6fdcd8c6e17cc5ec0a77.jpg"
	}
}