{
	"id": "8b3ca896-d504-45a4-9f30-518389a620cb",
	"created_at": "2026-04-06T00:08:09.683309Z",
	"updated_at": "2026-04-10T03:35:53.455193Z",
	"deleted_at": null,
	"sha1_hash": "9530beb3822229600ff85465130d41ebf12b7a33",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45752,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 17:16:02 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool CrossC2\r\n Tool: CrossC2\r\nNames CrossC2\r\nCategory Tools\r\nType Backdoor\r\nDescription\r\nCrossC2Kit is an infiltration expansion around the Unix platform derived from CrossC2. Use\r\nAggressor Script Open Source Script engine. It can be used to create automation to simulate\r\nthe operation process of the Red Team and expand the CobaltStrike client.\r\nInformation \u003chttps://github.com/gloxec/CrossC2\u003e\r\nLast change to this tool card: 27 August 2024\r\nDownload this tool card in JSON format\r\nAll groups using tool CrossC2\r\nChanged Name Country Observed\r\nAPT groups\r\n  TAG-100 2024  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=612fbd80-7efb-4f2c-8e10-381369102f63\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=612fbd80-7efb-4f2c-8e10-381369102f63\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=612fbd80-7efb-4f2c-8e10-381369102f63"
	],
	"report_names": [
		"listgroups.cgi?u=612fbd80-7efb-4f2c-8e10-381369102f63"
	],
	"threat_actors": [
		{
			"id": "64a08f65-4ef8-4ad5-bac1-ce4e0fd2808c",
			"created_at": "2024-08-28T02:02:09.663698Z",
			"updated_at": "2026-04-10T02:00:04.927384Z",
			"deleted_at": null,
			"main_name": "TAG-100",
			"aliases": [
				"Storm-2077"
			],
			"source_name": "ETDA:TAG-100",
			"tools": [
				"Agentemis",
				"Cobalt Strike",
				"CobaltStrike",
				"CrossC2",
				"LESLIELOADER",
				"Pantegana",
				"SparkRAT",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "db5b833a-965e-4f46-b75d-7e829466a5fa",
			"created_at": "2024-12-21T02:00:02.843374Z",
			"updated_at": "2026-04-10T02:00:03.780907Z",
			"deleted_at": null,
			"main_name": "Storm-2077",
			"aliases": [
				"TAG-100",
				"RedNovember"
			],
			"source_name": "MISPGALAXY:Storm-2077",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434089,
	"ts_updated_at": 1775792153,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9530beb3822229600ff85465130d41ebf12b7a33.pdf",
		"text": "https://archive.orkl.eu/9530beb3822229600ff85465130d41ebf12b7a33.txt",
		"img": "https://archive.orkl.eu/9530beb3822229600ff85465130d41ebf12b7a33.jpg"
	}
}