{
	"id": "2270332f-8031-499b-adc2-421b99558e0b",
	"created_at": "2026-04-06T00:20:04.867254Z",
	"updated_at": "2026-04-10T03:21:58.962964Z",
	"deleted_at": null,
	"sha1_hash": "910ce366324cc4ec08460a712c95d338ae3d26ae",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48715,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 16:37:57 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Numando\n Tool: Numando\nNames Numando\nCategory Malware\nType Banking trojan, Reconnaissance, Backdoor, Keylogger, Info stealer, Credential stealer\nDescription\n(ESET) The threat actor behind this malware family has been active since at least 2018. Even\nthough it is not nearly as lively as Mekotio or Grandoreiro, it has been consistently used since\nwe started tracking it, bringing interesting new techniques to the pool of Latin American\nbanking trojans’ tricks, like using seemingly useless ZIP archives or bundling payloads with\ndecoy BMP images. Geographically, it focuses almost exclusively on Brazil with rare\ncampaigns in Mexico and Spain.\nInformation\nMalpedia Last change to this tool card: 28 December 2021\nDownload this tool card in JSON format\nAll groups using tool Numando\nChanged Name Country Observed\nUnknown groups\n _[ Interesting malware not linked to an actor yet ]_\n1 group listed (0 APT, 0 other, 1 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=69a2b688-207b-49f4-a1f8-8ac568b6eca9\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=69a2b688-207b-49f4-a1f8-8ac568b6eca9\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=69a2b688-207b-49f4-a1f8-8ac568b6eca9"
	],
	"report_names": [
		"listgroups.cgi?u=69a2b688-207b-49f4-a1f8-8ac568b6eca9"
	],
	"threat_actors": [],
	"ts_created_at": 1775434804,
	"ts_updated_at": 1775791318,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/910ce366324cc4ec08460a712c95d338ae3d26ae.pdf",
		"text": "https://archive.orkl.eu/910ce366324cc4ec08460a712c95d338ae3d26ae.txt",
		"img": "https://archive.orkl.eu/910ce366324cc4ec08460a712c95d338ae3d26ae.jpg"
	}
}