{
	"id": "d5ce5d44-4c64-4600-b5da-c5bf33f0b554",
	"created_at": "2026-04-06T01:30:47.308633Z",
	"updated_at": "2026-04-10T03:29:45.340022Z",
	"deleted_at": null,
	"sha1_hash": "a466ca29efcbfa680c36f1746949c32b9d1e26fb",
	"title": "Operation Olympic Games - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 64188,
	"plain_text": "Operation Olympic Games - Threat Group Cards: A Threat Actor\r\nEncyclopedia\r\nArchived: 2026-04-06 00:55:53 UTC\r\nHome \u003e List all groups \u003e Operation Olympic Games\r\n APT group: Operation Olympic Games\r\nNames\r\nOperation Olympic Games (self given)\r\nGOSSIPGIRL (?)\r\nCountry\r\n USA\r\n Israel\r\nSponsor State-sponsored, Equation Group (NSA), CIA and Unit 8200\r\nMotivation Information theft and espionage, Sabotage and destruction\r\nFirst seen 2007\r\nDescription\r\nThe events have been described in detail in the 2015 book Countdown to Zero Day and the\r\n2016 documentary Zero Days. The piece of crucial information that was missing from both\r\nsources, how the malware was actually brought inside the facility, was documented in an\r\ninvestigative report in 2019.\r\n(The New York Times) From his first months in office, President Obama secretly ordered\r\nincreasingly sophisticated attacks on the computer systems that run Iran’s main nuclear\r\nenrichment facilities, significantly expanding America’s first sustained use of cyberweapons,\r\naccording to participants in the program.\r\nMr. Obama decided to accelerate the attacks — begun in the Bush administration and code-named Olympic Games — even after an element of the program accidentally became public in\r\nthe summer of 2010 because of a programming error that allowed it to escape Iran’s Natanz\r\nplant and sent it around the world on the Internet. Computer security experts who began\r\nstudying the worm, which had been developed by the United States and Israel, gave it a name:\r\nStuxnet.\r\nObserved\r\nSectors: Energy.\r\nCountries: Iran.\r\nTools used Stuxnet.\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=40c47a97-22a5-46d3-978e-f89c802dad93\r\nPage 1 of 2\n\nInformation\nLast change to this card: 17 January 2024\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=40c47a97-22a5-46d3-978e-f89c802dad93\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=40c47a97-22a5-46d3-978e-f89c802dad93\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=40c47a97-22a5-46d3-978e-f89c802dad93"
	],
	"report_names": [
		"showcard.cgi?u=40c47a97-22a5-46d3-978e-f89c802dad93"
	],
	"threat_actors": [
		{
			"id": "b740943a-da51-4133-855b-df29822531ea",
			"created_at": "2022-10-25T15:50:23.604126Z",
			"updated_at": "2026-04-10T02:00:05.259593Z",
			"deleted_at": null,
			"main_name": "Equation",
			"aliases": [
				"Equation"
			],
			"source_name": "MITRE:Equation",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "d7c5a1bf-85c9-4d2f-bdbd-1455f5f2ae65",
			"created_at": "2022-10-25T16:07:23.978074Z",
			"updated_at": "2026-04-10T02:00:04.817311Z",
			"deleted_at": null,
			"main_name": "Operation Olympic Games",
			"aliases": [
				"GOSSIPGIRL"
			],
			"source_name": "ETDA:Operation Olympic Games",
			"tools": [
				"Stuxnet",
				"W32.Stuxnet"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "fea75bf4-c510-4146-bbac-0802351f4eb0",
			"created_at": "2023-01-06T13:46:38.714847Z",
			"updated_at": "2026-04-10T02:00:03.076837Z",
			"deleted_at": null,
			"main_name": "Unit 8200",
			"aliases": [
				"Duqu Group"
			],
			"source_name": "MISPGALAXY:Unit 8200",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "08623296-52be-4977-8622-50efda44e9cc",
			"created_at": "2023-01-06T13:46:38.549387Z",
			"updated_at": "2026-04-10T02:00:03.020003Z",
			"deleted_at": null,
			"main_name": "Equation Group",
			"aliases": [
				"Tilded Team",
				"EQGRP",
				"G0020"
			],
			"source_name": "MISPGALAXY:Equation Group",
			"tools": [
				"TripleFantasy",
				"GrayFish",
				"EquationLaser",
				"EquationDrug",
				"DoubleFantasy"
			],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "2d9fbbd7-e4c3-40e5-b751-27af27c8610b",
			"created_at": "2024-05-01T02:03:08.144214Z",
			"updated_at": "2026-04-10T02:00:03.674763Z",
			"deleted_at": null,
			"main_name": "PLATINUM COLONY",
			"aliases": [
				"Equation Group "
			],
			"source_name": "Secureworks:PLATINUM COLONY",
			"tools": [
				"DoubleFantasy",
				"EquationDrug",
				"EquationLaser",
				"Fanny",
				"GrayFish",
				"TripleFantasy"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "e0fed6e6-a593-4041-80ef-694261825937",
			"created_at": "2022-10-25T16:07:23.593572Z",
			"updated_at": "2026-04-10T02:00:04.680752Z",
			"deleted_at": null,
			"main_name": "Equation Group",
			"aliases": [
				"APT-C-40",
				"G0020",
				"Platinum Colony",
				"Tilded Team"
			],
			"source_name": "ETDA:Equation Group",
			"tools": [
				"Bvp47",
				"DEMENTIAWHEEL",
				"DOUBLEFANTASY",
				"DanderSpritz",
				"DarkPulsar",
				"DoubleFantasy",
				"DoubleFeature",
				"DoublePulsar",
				"Duqu",
				"EQUATIONDRUG",
				"EQUATIONLASER",
				"EQUESTRE",
				"Flamer",
				"GRAYFISH",
				"GROK",
				"OddJob",
				"Plexor",
				"Prax",
				"Regin",
				"Skywiper",
				"TRIPLEFANTASY",
				"Tilded",
				"UNITEDRAKE",
				"WarriorPride",
				"sKyWIper"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775439047,
	"ts_updated_at": 1775791785,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/a466ca29efcbfa680c36f1746949c32b9d1e26fb.pdf",
		"text": "https://archive.orkl.eu/a466ca29efcbfa680c36f1746949c32b9d1e26fb.txt",
		"img": "https://archive.orkl.eu/a466ca29efcbfa680c36f1746949c32b9d1e26fb.jpg"
	}
}