{
	"id": "fd214ff4-8c1e-4838-a7d4-0b919bbb9e5e",
	"created_at": "2026-04-06T00:17:28.984423Z",
	"updated_at": "2026-04-10T13:12:58.593942Z",
	"deleted_at": null,
	"sha1_hash": "86401d50a28a450c2e90105b1a0aaae81b5e16a7",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45839,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 19:01:21 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool BlankBot\r\n Tool: BlankBot\r\nNames BlankBot\r\nCategory Malware\r\nType Banking trojan, Backdoor, Info stealer, Credential stealer\r\nDescription\r\n(Intel471) In July 2024, Intel 471 Malware Intelligence researchers discovered the new\r\nBlankBot Android banking trojan.\r\nBased on the application names and certain strings found within the application, it is highly\r\nlikely BlankBot’s primary targets are Turkish users.\r\nBlankBot features a range of malicious capabilities, which include customer injections,\r\nkeylogging, screen recording and it communicates with a control server over a WebSocket\r\nconnection.\r\nInformation\r\n\u003chttps://intel471.com/blog/blankbot-a-new-android-banking-trojan-with-screen-recording-keylogging-and-remote-control-capabilities\u003e\r\nMalpedia \u003chttps://malpedia.caad.fkie.fraunhofer.de/details/apk.blankbot\u003e\r\nLast change to this tool card: 27 December 2024\r\nDownload this tool card in JSON format\r\nAll groups using tool BlankBot\r\nChanged Name Country Observed\r\nUnknown groups\r\n  _[ Interesting malware not linked to an actor yet ]_  \r\n1 group listed (0 APT, 0 other, 1 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3531375b-b63c-4b6c-8558-6ba176f2d75e\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3531375b-b63c-4b6c-8558-6ba176f2d75e\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3531375b-b63c-4b6c-8558-6ba176f2d75e"
	],
	"report_names": [
		"listgroups.cgi?u=3531375b-b63c-4b6c-8558-6ba176f2d75e"
	],
	"threat_actors": [],
	"ts_created_at": 1775434648,
	"ts_updated_at": 1775826778,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/86401d50a28a450c2e90105b1a0aaae81b5e16a7.pdf",
		"text": "https://archive.orkl.eu/86401d50a28a450c2e90105b1a0aaae81b5e16a7.txt",
		"img": "https://archive.orkl.eu/86401d50a28a450c2e90105b1a0aaae81b5e16a7.jpg"
	}
}