{
	"id": "a00ba046-9204-45f3-ab00-1044c6410d60",
	"created_at": "2026-04-06T00:06:49.529957Z",
	"updated_at": "2026-04-10T13:11:24.383743Z",
	"deleted_at": null,
	"sha1_hash": "84e9fb6da97c1294ad668138eabce3a2d294f5fa",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 53692,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 15:16:01 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool SILENTUPLOADER\r\n Tool: SILENTUPLOADER\r\nNames SILENTUPLOADER\r\nCategory Malware\r\nType Exfiltration\r\nDescription\r\n(Mandiant) SILENTUPLOADER is an uploader written in MSIL that is dropped by\r\nDOSTEALER and is designed to work specifically in tandem with it. It checks for files in a\r\nspecified folder every 30 seconds and uploads them to a remote server.\r\nInformation \u003chttps://www.mandiant.com/media/17826\u003e\r\nMalpedia \u003chttps://malpedia.caad.fkie.fraunhofer.de/details/win.silentuploader\u003e\r\nLast change to this tool card: 22 June 2023\r\nDownload this tool card in JSON format\r\nAll groups using tool SILENTUPLOADER\r\nChanged Name Country Observed\r\nAPT groups\r\n  APT 42 2015-Feb 2024  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b266acee-e395-4283-ba2a-e9351886cc7f\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b266acee-e395-4283-ba2a-e9351886cc7f\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b266acee-e395-4283-ba2a-e9351886cc7f"
	],
	"report_names": [
		"listgroups.cgi?u=b266acee-e395-4283-ba2a-e9351886cc7f"
	],
	"threat_actors": [
		{
			"id": "9f778366-a4a7-42f1-ab1e-362aa065ee4f",
			"created_at": "2022-10-25T16:07:23.362157Z",
			"updated_at": "2026-04-10T02:00:04.562925Z",
			"deleted_at": null,
			"main_name": "APT 42",
			"aliases": [
				"GreenBravo"
			],
			"source_name": "ETDA:APT 42",
			"tools": [
				"BROKEYOLK",
				"CHAIRSMACK",
				"CORRUPT KITTEN",
				"DOSTEALER",
				"GORBLE",
				"Ghambar",
				"MAGICDROP",
				"PINEFLOWER",
				"POWERPOST",
				"SILENTUPLOADER",
				"TABBYCAT",
				"TAMECAT",
				"VBREVSHELL",
				"VINETHORN"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434009,
	"ts_updated_at": 1775826684,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/84e9fb6da97c1294ad668138eabce3a2d294f5fa.pdf",
		"text": "https://archive.orkl.eu/84e9fb6da97c1294ad668138eabce3a2d294f5fa.txt",
		"img": "https://archive.orkl.eu/84e9fb6da97c1294ad668138eabce3a2d294f5fa.jpg"
	}
}