{
	"id": "3492863d-dd0c-4bf0-9bb1-2388c1aa0d8a",
	"created_at": "2026-04-06T00:14:25.788712Z",
	"updated_at": "2026-04-10T03:37:23.807858Z",
	"deleted_at": null,
	"sha1_hash": "ad3288c5fb623258a8513b3893df5442ce7027c5",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48512,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 13:14:07 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Sliver\n Tool: Sliver\nNames Sliver\nCategory Tools\nType Vulnerability scanner\nDescription\nSliver is an open source, cross-platform adversary simulation/red team platform, it can be\nused by organizations of all sizes to perform security testing. Sliver's implants support C2\nover Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS. Implants are dynamically\ncompiled with unique X.509 certificates signed by a per-instance certificate authority\ngenerated when you first run the binary.\nInformation\nMITRE ATT\u0026CK Malpedia Last change to this tool card: 06 September 2023\nDownload this tool card in JSON format\nAll groups using tool Sliver\nChanged Name Country Observed\nOther groups\n TA551, Shathak 2016-Jan 2021\n1 group listed (0 APT, 1 other, 0 unknown)\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45579150-0bcf-4941-9e69-3326d4181e54\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45579150-0bcf-4941-9e69-3326d4181e54\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45579150-0bcf-4941-9e69-3326d4181e54\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45579150-0bcf-4941-9e69-3326d4181e54"
	],
	"report_names": [
		"listgroups.cgi?u=45579150-0bcf-4941-9e69-3326d4181e54"
	],
	"threat_actors": [
		{
			"id": "26a04131-2b8c-4e5d-8f38-5c58b86f5e7f",
			"created_at": "2022-10-25T15:50:23.579601Z",
			"updated_at": "2026-04-10T02:00:05.360509Z",
			"deleted_at": null,
			"main_name": "TA551",
			"aliases": [
				"TA551",
				"GOLD CABIN",
				"Shathak"
			],
			"source_name": "MITRE:TA551",
			"tools": [
				"QakBot",
				"IcedID",
				"Valak",
				"Ursnif"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "40b623c7-b621-48db-b55b-dd4f6746fbc6",
			"created_at": "2024-06-19T02:03:08.017681Z",
			"updated_at": "2026-04-10T02:00:03.665818Z",
			"deleted_at": null,
			"main_name": "GOLD CABIN",
			"aliases": [
				"Shathak",
				"TA551 "
			],
			"source_name": "Secureworks:GOLD CABIN",
			"tools": [],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "90f216f2-4897-46fc-bb76-3acae9d112ca",
			"created_at": "2023-01-06T13:46:39.248936Z",
			"updated_at": "2026-04-10T02:00:03.260122Z",
			"deleted_at": null,
			"main_name": "GOLD CABIN",
			"aliases": [
				"Shakthak",
				"TA551",
				"ATK236",
				"G0127",
				"Monster Libra"
			],
			"source_name": "MISPGALAXY:GOLD CABIN",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "04e34cab-3ee4-4f06-a6f6-5cdd7eccfd68",
			"created_at": "2022-10-25T16:07:24.578896Z",
			"updated_at": "2026-04-10T02:00:05.039955Z",
			"deleted_at": null,
			"main_name": "TA551",
			"aliases": [
				"G0127",
				"Gold Cabin",
				"Monster Libra",
				"Shathak",
				"TA551"
			],
			"source_name": "ETDA:TA551",
			"tools": [
				"BokBot",
				"CRM",
				"Gozi",
				"Gozi CRM",
				"IceID",
				"IcedID",
				"Papras",
				"Snifula",
				"Ursnif",
				"Valak",
				"Valek"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434465,
	"ts_updated_at": 1775792243,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ad3288c5fb623258a8513b3893df5442ce7027c5.pdf",
		"text": "https://archive.orkl.eu/ad3288c5fb623258a8513b3893df5442ce7027c5.txt",
		"img": "https://archive.orkl.eu/ad3288c5fb623258a8513b3893df5442ce7027c5.jpg"
	}
}