{
	"id": "54fc90a7-86b6-47e0-b0d6-7c2d3590094f",
	"created_at": "2026-04-06T01:31:52.385447Z",
	"updated_at": "2026-04-10T03:25:39.995378Z",
	"deleted_at": null,
	"sha1_hash": "97cbc46f24fbf47a75583c5e5e3a4dc6151dc677",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 49211,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 00:32:37 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Nemty\n Tool: Nemty\nNames Nemty\nCategory Malware\nType Ransomware, Big Game Hunting\nDescription\n(BleepingComputer) Nemty ransomware was first spotted in August 2019 and is known\nfor deleting the shadow copies of all the files it encrypts, making it impossible for victims\nwho don't have separate backups to recover their data.\nInformation\nMalpedia AlienVault OTX Playbook Last change to this tool card: 25 April 2021\nDownload this tool card in JSON format\nAll groups using tool Nemty\nChanged Name Country Observed\nAPT groups\n Traveling Spider [Unknown] 2019-Mar 2021\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6907344a-046f-46c1-984a-7ada76c99b7a\nPage 1 of 2\n\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6907344a-046f-46c1-984a-7ada76c99b7a\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6907344a-046f-46c1-984a-7ada76c99b7a\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6907344a-046f-46c1-984a-7ada76c99b7a"
	],
	"report_names": [
		"listgroups.cgi?u=6907344a-046f-46c1-984a-7ada76c99b7a"
	],
	"threat_actors": [
		{
			"id": "8b7faa58-947b-4530-ab1f-250a0370aabf",
			"created_at": "2022-10-25T16:07:24.34248Z",
			"updated_at": "2026-04-10T02:00:04.945921Z",
			"deleted_at": null,
			"main_name": "Traveling Spider",
			"aliases": [
				"Gold Mansard"
			],
			"source_name": "ETDA:Traveling Spider",
			"tools": [
				"7-Zip",
				"AdFind",
				"LaZagne",
				"MEGAsync",
				"Mimikatz",
				"Nefilim",
				"Nemty",
				"Nephilim",
				"Network Password Recovery",
				"PsExec",
				"smbtool"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "1c76f1b6-a05b-4dba-82ea-07011b47c6cd",
			"created_at": "2023-01-06T13:46:39.201507Z",
			"updated_at": "2026-04-10T02:00:03.244851Z",
			"deleted_at": null,
			"main_name": "TRAVELING SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:TRAVELING SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775439112,
	"ts_updated_at": 1775791539,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/97cbc46f24fbf47a75583c5e5e3a4dc6151dc677.pdf",
		"text": "https://archive.orkl.eu/97cbc46f24fbf47a75583c5e5e3a4dc6151dc677.txt",
		"img": "https://archive.orkl.eu/97cbc46f24fbf47a75583c5e5e3a4dc6151dc677.jpg"
	}
}