{
	"id": "bf47709d-ef89-4232-8841-e25879a35511",
	"created_at": "2026-04-06T00:15:42.368905Z",
	"updated_at": "2026-04-10T03:20:24.515851Z",
	"deleted_at": null,
	"sha1_hash": "9fc7348efdab5f4c68fce07f4db8183696c494d2",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48647,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 17:18:55 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool ZitMo\n Tool: ZitMo\nNames\nZitMo\nZeuS-in-the-Mobile\nCategory Malware\nType Banking trojan, Backdoor, Info stealer, Credential stealer\nDescription\n(Kaspersky) The first version of ZeuS-in-the-Mobile (ZitMo), malware which targets mTANs,\nwas discovered in the end of September 2010. In that case it was targeting Symbian\nsmartphones. Later on, ZitMo versions for Windows Mobile and Blackberry were found. It\ncomes as no surprise that cybercriminals have created new and sophisticated pieces of mobile\nmalware for Symbian and Windows Mobile; more surprising is that Blackberry devices were\nalso targeted; and even more surprising is that until July 2011 there was no evidence of ZitMo\nfor Android’s existence. And now please ‘welcome’ ZeuS-in-the-Mobile for Android.\nThe first fact that must be mentioned is that ZitMo for Android differs from Symbian,\nWindows Mobile and Blackberry versions a lot. The functionality and logic of ZitMo for\nSymbian, Windows Mobile and Blackberry is the same: C\u0026C cell phone number, SMS\ncommands, and the ability to forward SMS messages from a particular number, as well as the\nability to change C\u0026C.\nThe functionality and logic of ZitMo for Android is far more primitive. The APK file itself has\na 19k size. It passes itself off as a security tool from the ‘Trusteer’ company.\nInformation Malpedia Last change to this tool card: 24 April 2021\nDownload this tool card in JSON format\nAll groups using tool ZitMo\nChanged Name Country Observed\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea\nPage 1 of 2\n\nUnknown groups\r\n  _[ Interesting malware not linked to an actor yet ]_  \r\n1 group listed (0 APT, 0 other, 1 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea"
	],
	"report_names": [
		"listgroups.cgi?u=794d2676-4694-4d32-b880-51e4f9660aea"
	],
	"threat_actors": [],
	"ts_created_at": 1775434542,
	"ts_updated_at": 1775791224,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/9fc7348efdab5f4c68fce07f4db8183696c494d2.pdf",
		"text": "https://archive.orkl.eu/9fc7348efdab5f4c68fce07f4db8183696c494d2.txt",
		"img": "https://archive.orkl.eu/9fc7348efdab5f4c68fce07f4db8183696c494d2.jpg"
	}
}