{
	"id": "3dbbe2a7-e472-4a85-b6f7-7d3a70fba8a7",
	"created_at": "2026-04-06T00:21:44.388971Z",
	"updated_at": "2026-04-10T13:12:44.425846Z",
	"deleted_at": null,
	"sha1_hash": "8bce141ad2c46b82c8eec73ec09a83dd51ce0655",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 44115,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 19:46:12 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool CommonMagic\n Tool: CommonMagic\nNames CommonMagic\nCategory Malware\nType Backdoor\nDescription\n(Kaspersky) All the victims of PowerMagic were also infected with a more complicated,\npreviously unseen, modular malicious framework that we named CommonMagic. This\nframework was deployed after initial infection with the PowerShell backdoor, leading us to\nbelieve that CommonMagic is deployed via PowerMagic.\nInformation Malpedia Last change to this tool card: 22 June 2023\nDownload this tool card in JSON format\nAll groups using tool CommonMagic\nChanged Name Country Observed\nAPT groups\n Bad Magic, RedStinger [Unknown] 2020-May 2023\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=60f086b5-9fb3-4c03-a8b2-5ce2862794c1\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=60f086b5-9fb3-4c03-a8b2-5ce2862794c1\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=60f086b5-9fb3-4c03-a8b2-5ce2862794c1"
	],
	"report_names": [
		"listgroups.cgi?u=60f086b5-9fb3-4c03-a8b2-5ce2862794c1"
	],
	"threat_actors": [
		{
			"id": "3f918a1b-2f20-4f3f-ae16-31e83d9d91d9",
			"created_at": "2023-06-23T02:04:34.088425Z",
			"updated_at": "2026-04-10T02:00:04.573175Z",
			"deleted_at": null,
			"main_name": "Bad Magic",
			"aliases": [
				"Bad Magic",
				"CloudWizard",
				"RedStinger"
			],
			"source_name": "ETDA:Bad Magic",
			"tools": [
				"CommonMagic",
				"PowerMagic"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "ff5a7bd9-75a5-43fe-ba4c-27dab43e1f61",
			"created_at": "2023-11-07T02:00:07.086058Z",
			"updated_at": "2026-04-10T02:00:03.403516Z",
			"deleted_at": null,
			"main_name": "RedStinger",
			"aliases": [
				"Bad Magic"
			],
			"source_name": "MISPGALAXY:RedStinger",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434904,
	"ts_updated_at": 1775826764,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/8bce141ad2c46b82c8eec73ec09a83dd51ce0655.pdf",
		"text": "https://archive.orkl.eu/8bce141ad2c46b82c8eec73ec09a83dd51ce0655.txt",
		"img": "https://archive.orkl.eu/8bce141ad2c46b82c8eec73ec09a83dd51ce0655.jpg"
	}
}