{
	"id": "ce76017d-8241-4549-9440-0c9157c1d970",
	"created_at": "2026-04-06T03:37:52.775634Z",
	"updated_at": "2026-04-10T13:11:35.843066Z",
	"deleted_at": null,
	"sha1_hash": "84c75b988053548961764e67156c7f21c2fc9781",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46565,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 03:18:18 UTC\nHome \u003e List all groups \u003e RevengeHotels\n APT group: RevengeHotels\nNames RevengeHotels (Kaspersky)\nCountry [Unknown]\nMotivation Information theft and espionage\nFirst seen 2015\nDescription\n(Kaspersky) RevengeHotels is a campaign that has been active since at least 2015, revealing\ndifferent groups using traditional RAT malware to infect businesses in the hospitality sector.\nWhile there is a marked interest in Brazilian victims, our telemetry shows that their reach has\nextended to other countries in Latin America and beyond.\nThe use of spear-phishing emails, malicious documents and RAT malware is yielding\nsignificant results for at least two groups we have identified in this campaign. Other threat\nactors may also be part of this wave of attacks, though there is no confirmation at the current\ntime.\nObserved\nSectors: Hospitality.\nCountries: Argentina, Bolivia, Brazil, Chile, Costa Rica, France, Italy, Mexico, Portugal,\nSpain, Thailand, Turkey.\nTools used 888 RAT, NanoCore RAT, njRAT, RevengeRAT.\nInformation Last change to this card: 14 April 2020\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e1bdf2aa-a235-4f3e-bbbe-a7e7c70de802\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=e1bdf2aa-a235-4f3e-bbbe-a7e7c70de802\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e1bdf2aa-a235-4f3e-bbbe-a7e7c70de802"
	],
	"report_names": [
		"showcard.cgi?u=e1bdf2aa-a235-4f3e-bbbe-a7e7c70de802"
	],
	"threat_actors": [
		{
			"id": "bfae615f-cb9c-479c-b97d-ba282c322db3",
			"created_at": "2022-10-25T16:07:24.123308Z",
			"updated_at": "2026-04-10T02:00:04.874176Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "ETDA:RevengeHotels",
			"tools": [
				"888 RAT",
				"Atros2.CKPN",
				"Bladabindi",
				"Jorik",
				"Nancrat",
				"NanoCore",
				"NanoCore RAT",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Zurten",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "31a4f4ad-1aa7-48c2-8b16-58d48879644c",
			"created_at": "2024-02-06T02:00:04.13577Z",
			"updated_at": "2026-04-10T02:00:03.576453Z",
			"deleted_at": null,
			"main_name": "RevengeHotels",
			"aliases": [],
			"source_name": "MISPGALAXY:RevengeHotels",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775446672,
	"ts_updated_at": 1775826695,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/84c75b988053548961764e67156c7f21c2fc9781.pdf",
		"text": "https://archive.orkl.eu/84c75b988053548961764e67156c7f21c2fc9781.txt",
		"img": "https://archive.orkl.eu/84c75b988053548961764e67156c7f21c2fc9781.jpg"
	}
}