{
	"id": "d6b10276-694d-46f5-b408-43fe90341d29",
	"created_at": "2026-04-06T00:19:25.851251Z",
	"updated_at": "2026-04-10T13:11:41.7359Z",
	"deleted_at": null,
	"sha1_hash": "a3855267d755a0d5ec55e66b64f6cc22c2760baa",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48221,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 14:15:56 UTC\n APT group: Scarab\nNames\nScarab (Symantec)\nUAC-0026 (CERT-UA)\nCountry China\nMotivation Information theft and espionage\nFirst seen 2012\nDescription\n(Symantec) A group of attackers, which we call Scarab, has been performing highly targeted\nattacks against particular Russian-speaking individuals both inside and outside of Russia since at\nleast January 2012. In each campaign, the attackers typically target a small amount of individuals\n—rather than enterprises or governments—using economic, military, topical, or generic lures. On\naverage, less than ten unique computers are infected per month and there is no indication that the\nattackers are trying to spread through the victim’s local network, suggesting that Scarab’s\ncampaigns are extremely targeted in nature.\nObserved Countries: Russia, Syria, Ukraine, USA.\nTools used Scieron.\nOperations performed Mar 2022\nChinese Threat Actor Scarab Targeting Ukraine\nInformation\nLast change to this card: 04 April 2022\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=fdce7dae-4820-43ae-b2c7-8dc50e010c6c\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=fdce7dae-4820-43ae-b2c7-8dc50e010c6c\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=fdce7dae-4820-43ae-b2c7-8dc50e010c6c"
	],
	"report_names": [
		"showcard.cgi?u=fdce7dae-4820-43ae-b2c7-8dc50e010c6c"
	],
	"threat_actors": [
		{
			"id": "9099912b-a00a-4afb-8294-c6d35af421a1",
			"created_at": "2023-01-06T13:46:39.338108Z",
			"updated_at": "2026-04-10T02:00:03.292102Z",
			"deleted_at": null,
			"main_name": "Scarab",
			"aliases": [],
			"source_name": "MISPGALAXY:Scarab",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e7d03ac8-7d6f-4ea0-83a9-10dff2ea1486",
			"created_at": "2022-10-25T16:07:24.158325Z",
			"updated_at": "2026-04-10T02:00:04.884772Z",
			"deleted_at": null,
			"main_name": "Scarab",
			"aliases": [
				"UAC-0026"
			],
			"source_name": "ETDA:Scarab",
			"tools": [
				"Scieron"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434765,
	"ts_updated_at": 1775826701,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a3855267d755a0d5ec55e66b64f6cc22c2760baa.pdf",
		"text": "https://archive.orkl.eu/a3855267d755a0d5ec55e66b64f6cc22c2760baa.txt",
		"img": "https://archive.orkl.eu/a3855267d755a0d5ec55e66b64f6cc22c2760baa.jpg"
	}
}