{
	"id": "94261610-2fa4-4e1b-8647-6dfc9c089f92",
	"created_at": "2026-04-06T00:10:15.644998Z",
	"updated_at": "2026-04-10T03:30:01.596938Z",
	"deleted_at": null,
	"sha1_hash": "852f4c4ae6d7d8343cc31cd02c787c8d87482f1f",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 49594,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-02 10:38:06 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool DinodasRAT\n Tool: DinodasRAT\nNames\nDinodasRAT\nXDealer\nCategory Malware\nType Backdoor, Info stealer\nDescription\n(ESET) DinodasRAT is a previously undocumented remote access trojan developed in C++\nwith various capabilities that allow an attacker to spy on and collect sensitive information from\na victim’s computer.\nInformation\nMalpedia Last change to this tool card: 22 April 2024\nDownload this tool card in JSON format\nAll groups using tool DinodasRAT\nChanged Name Country Observed\nAPT groups\n Earth Krahang 2022\n Operation Jacana 2023\n2 groups listed (2 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=550f65cc-b38a-48bb-abb4-685035322d94\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=550f65cc-b38a-48bb-abb4-685035322d94\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=550f65cc-b38a-48bb-abb4-685035322d94"
	],
	"report_names": [
		"listgroups.cgi?u=550f65cc-b38a-48bb-abb4-685035322d94"
	],
	"threat_actors": [
		{
			"id": "d5451198-ac6b-40af-b8ef-1afb549c2dc8",
			"created_at": "2024-03-21T02:00:04.728286Z",
			"updated_at": "2026-04-10T02:00:03.60345Z",
			"deleted_at": null,
			"main_name": "Earth Krahang",
			"aliases": [],
			"source_name": "MISPGALAXY:Earth Krahang",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f86ac24d-0aef-425c-8087-c0dd270060b9",
			"created_at": "2024-04-24T02:02:07.638437Z",
			"updated_at": "2026-04-10T02:00:04.663683Z",
			"deleted_at": null,
			"main_name": "Earth Krahang",
			"aliases": [],
			"source_name": "ETDA:Earth Krahang",
			"tools": [
				"Agent.dhwf",
				"Agentemis",
				"Cobalt Strike",
				"CobaltStrike",
				"Destroy RAT",
				"DestroyRAT",
				"DinodasRAT",
				"Kaba",
				"Korplug",
				"POISONPLUG.SHADOW",
				"PlugX",
				"RedDelta",
				"Reshell",
				"ShadowPad Winnti",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"XDealer",
				"XShellGhost",
				"Xamtrav",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "61c3f4b4-afd9-4187-91c3-ba6dfeeb6470",
			"created_at": "2023-10-14T02:03:14.355977Z",
			"updated_at": "2026-04-10T02:00:04.811984Z",
			"deleted_at": null,
			"main_name": "Operation Jacana",
			"aliases": [],
			"source_name": "ETDA:Operation Jacana",
			"tools": [
				"Agent.dhwf",
				"Destroy RAT",
				"DestroyRAT",
				"DinodasRAT",
				"Impacket",
				"Kaba",
				"Korplug",
				"PlugX",
				"RedDelta",
				"SoftEther VPN",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"XDealer",
				"Xamtrav"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434215,
	"ts_updated_at": 1775791801,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/852f4c4ae6d7d8343cc31cd02c787c8d87482f1f.pdf",
		"text": "https://archive.orkl.eu/852f4c4ae6d7d8343cc31cd02c787c8d87482f1f.txt",
		"img": "https://archive.orkl.eu/852f4c4ae6d7d8343cc31cd02c787c8d87482f1f.jpg"
	}
}