{
	"id": "07451e05-6a0c-4c4f-9c8e-efa0a6d02a24",
	"created_at": "2026-04-06T00:18:02.249909Z",
	"updated_at": "2026-04-10T03:37:22.7456Z",
	"deleted_at": null,
	"sha1_hash": "ada4940c7507dd29e7e758ef3ae83207409dd47c",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 57398,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 21:35:05 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Trochilus RAT\n Tool: Trochilus RAT\nNames Trochilus RAT\nCategory Malware\nType Reconnaissance, Backdoor, Info stealer, Downloader\nDescription\nDespite that the RAT was designed to execute in the memory of the machine (thus\nevading detection by AV software), ASERT researchers obtained the RAT’s source code\nand connected it to a GitHub profile of a user named 5loyd.\nOn the GitHub page, the RAT has been advertised as a fast and free Windows remote\nadministration tool. Other details include:\n• Written in CC+;\n• Supports various communication protocols;\n• Has a file manager module, a remote shell, a non-UAC mode;\n• Able to uninstall itself;\n• Able to upload information from remote machines;\n• Able to download an execute files.\nResearchers believe that 5loys is not a part of Group 27. More likely, the user’s profile has\nbeen hijacked by the group and used for their own purposes.\nInformation\nMalpedia AlienVault OTX Last change to this tool card: 14 May 2020\nDownload this tool card in JSON format\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=cfb2355d-e43d-43b7-8033-0fcba988db50\nPage 1 of 2\n\nAll groups using tool Trochilus RAT\r\nChanged Name Country Observed\r\nAPT groups\r\n  APT 31, Judgment Panda, Zirconium 2016-Mar 2024\r\n  Earth Berberoka 2022  \r\n  Nightshade Panda, APT 9, Group 27 2013-Sep 2016  \r\n  Space Pirates 2017-Nov 2024  \r\n  Stone Panda, APT 10, menuPass 2006-Mar 2025\r\n5 groups listed (5 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=cfb2355d-e43d-43b7-8033-0fcba988db50\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=cfb2355d-e43d-43b7-8033-0fcba988db50\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=cfb2355d-e43d-43b7-8033-0fcba988db50"
	],
	"report_names": [
		"listgroups.cgi?u=cfb2355d-e43d-43b7-8033-0fcba988db50"
	],
	"threat_actors": [
		{
			"id": "ec14074c-8517-40e1-b4d7-3897f1254487",
			"created_at": "2023-01-06T13:46:38.300905Z",
			"updated_at": "2026-04-10T02:00:02.918468Z",
			"deleted_at": null,
			"main_name": "APT10",
			"aliases": [
				"Red Apollo",
				"HOGFISH",
				"BRONZE RIVERSIDE",
				"G0045",
				"TA429",
				"Purple Typhoon",
				"STONE PANDA",
				"Menupass Team",
				"happyyongzi",
				"CVNX",
				"Cloud Hopper",
				"ATK41",
				"Granite Taurus",
				"POTASSIUM"
			],
			"source_name": "MISPGALAXY:APT10",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "536ca49a-2666-4005-8a50-e552fc7e16ef",
			"created_at": "2023-11-21T02:00:07.375813Z",
			"updated_at": "2026-04-10T02:00:03.471967Z",
			"deleted_at": null,
			"main_name": "Webworm",
			"aliases": [
				"Space Pirates"
			],
			"source_name": "MISPGALAXY:Webworm",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "aacd5cbc-604b-4b6e-9e58-ef96c5d1a784",
			"created_at": "2023-01-06T13:46:38.953463Z",
			"updated_at": "2026-04-10T02:00:03.159523Z",
			"deleted_at": null,
			"main_name": "APT31",
			"aliases": [
				"JUDGMENT PANDA",
				"BRONZE VINEWOOD",
				"Red keres",
				"Violet Typhoon",
				"TA412"
			],
			"source_name": "MISPGALAXY:APT31",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "452d2d74-e812-45d6-b0fe-b8a6cc4ebd01",
			"created_at": "2022-10-25T16:07:23.562676Z",
			"updated_at": "2026-04-10T02:00:04.662064Z",
			"deleted_at": null,
			"main_name": "Earth Berberoka",
			"aliases": [
				"GamblingPuppet"
			],
			"source_name": "ETDA:Earth Berberoka",
			"tools": [
				"Agent.dhwf",
				"AngryRebel",
				"AsyncRAT",
				"CinaRAT",
				"Destroy RAT",
				"DestroyRAT",
				"Farfli",
				"Gh0st RAT",
				"Ghost RAT",
				"Kaba",
				"Korplug",
				"Moudour",
				"Mydoor",
				"PCRat",
				"PlugX",
				"PuppetLoader",
				"Quasar RAT",
				"QuasarRAT",
				"RedDelta",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trochilus RAT",
				"Xamtrav",
				"Yggdrasil",
				"oRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "ba9fa308-a29a-4928-9c06-73aafec7624c",
			"created_at": "2024-05-01T02:03:07.981061Z",
			"updated_at": "2026-04-10T02:00:03.750803Z",
			"deleted_at": null,
			"main_name": "BRONZE RIVERSIDE",
			"aliases": [
				"APT10 ",
				"CTG-5938 ",
				"CVNX ",
				"Hogfish ",
				"MenuPass ",
				"MirrorFace ",
				"POTASSIUM ",
				"Purple Typhoon ",
				"Red Apollo ",
				"Stone Panda "
			],
			"source_name": "Secureworks:BRONZE RIVERSIDE",
			"tools": [
				"ANEL",
				"AsyncRAT",
				"ChChes",
				"Cobalt Strike",
				"HiddenFace",
				"LODEINFO",
				"PlugX",
				"PoisonIvy",
				"QuasarRAT",
				"QuasarRAT Loader",
				"RedLeaves"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "9e6186dd-9334-4aac-9957-98f022cd3871",
			"created_at": "2022-10-25T15:50:23.357398Z",
			"updated_at": "2026-04-10T02:00:05.368552Z",
			"deleted_at": null,
			"main_name": "ZIRCONIUM",
			"aliases": [
				"APT31",
				"Violet Typhoon"
			],
			"source_name": "MITRE:ZIRCONIUM",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "699b7efc-322d-489d-818d-823fac028124",
			"created_at": "2023-01-06T13:46:39.404825Z",
			"updated_at": "2026-04-10T02:00:03.315524Z",
			"deleted_at": null,
			"main_name": "APT9",
			"aliases": [
				"NIGHTSHADE PANDA",
				"Red Pegasus",
				"Group 27"
			],
			"source_name": "MISPGALAXY:APT9",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "e79324a2-bdae-4dc5-9421-578a59045288",
			"created_at": "2022-10-25T16:07:23.906087Z",
			"updated_at": "2026-04-10T02:00:04.784657Z",
			"deleted_at": null,
			"main_name": "Nightshade Panda",
			"aliases": [
				"APT 9",
				"FlowerLady",
				"FlowerShow",
				"Group 27",
				"Nightshade Panda",
				"Operation Seven Pointed Dagger"
			],
			"source_name": "ETDA:Nightshade Panda",
			"tools": [
				"3102 RAT",
				"9002 RAT",
				"Agent.dhwf",
				"BKDR_EVILOGE",
				"BKDR_HGDER",
				"BKDR_NVICM",
				"Chymine",
				"Darkmoon",
				"Destroy RAT",
				"DestroyRAT",
				"EvilGrab",
				"EvilGrab RAT",
				"Gen:Trojan.Heur.PT",
				"HOMEUNIX",
				"HidraQ",
				"Homux",
				"Hydraq",
				"Kaba",
				"Korplug",
				"McRAT",
				"MdmBot",
				"MoonWind",
				"MoonWind RAT",
				"PlugX",
				"Poison Ivy",
				"RedDelta",
				"Roarur",
				"SPIVY",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trochilus RAT",
				"Vidgrab",
				"Wmonder",
				"Xamtrav",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "04b07437-41bb-4126-bcbb-def16f19d7c6",
			"created_at": "2022-10-25T16:07:24.232628Z",
			"updated_at": "2026-04-10T02:00:04.906097Z",
			"deleted_at": null,
			"main_name": "Stone Panda",
			"aliases": [
				"APT 10",
				"ATK 41",
				"Bronze Riverside",
				"CTG-5938",
				"CVNX",
				"Cuckoo Spear",
				"Earth Kasha",
				"G0045",
				"G0093",
				"Granite Taurus",
				"Happyyongzi",
				"Hogfish",
				"ITG01",
				"Operation A41APT",
				"Operation Cache Panda",
				"Operation ChessMaster",
				"Operation Cloud Hopper",
				"Operation Cuckoo Spear",
				"Operation New Battle",
				"Operation Soft Cell",
				"Operation TradeSecret",
				"Potassium",
				"Purple Typhoon",
				"Red Apollo",
				"Stone Panda",
				"TA429",
				"menuPass",
				"menuPass Team"
			],
			"source_name": "ETDA:Stone Panda",
			"tools": [
				"Agent.dhwf",
				"Agentemis",
				"Anel",
				"AngryRebel",
				"BKDR_EVILOGE",
				"BKDR_HGDER",
				"BKDR_NVICM",
				"BUGJUICE",
				"CHINACHOPPER",
				"ChChes",
				"China Chopper",
				"Chymine",
				"CinaRAT",
				"Cobalt Strike",
				"CobaltStrike",
				"DARKTOWN",
				"DESLoader",
				"DILLJUICE",
				"DILLWEED",
				"Darkmoon",
				"DelfsCake",
				"Derusbi",
				"Destroy RAT",
				"DestroyRAT",
				"Ecipekac",
				"Emdivi",
				"EvilGrab",
				"EvilGrab RAT",
				"FYAnti",
				"Farfli",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"GreetCake",
				"HAYMAKER",
				"HEAVYHAND",
				"HEAVYPOT",
				"HTran",
				"HUC Packet Transmit Tool",
				"Ham Backdoor",
				"HiddenFace",
				"Impacket",
				"Invoke the Hash",
				"KABOB",
				"Kaba",
				"Korplug",
				"LODEINFO",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"MiS-Type",
				"Mimikatz",
				"Moudour",
				"Mydoor",
				"NBTscan",
				"NOOPDOOR",
				"Newsripper",
				"P8RAT",
				"PCRat",
				"PlugX",
				"Poison Ivy",
				"Poldat",
				"PowerSploit",
				"PowerView",
				"PsExec",
				"PsList",
				"Quarks PwDump",
				"Quasar RAT",
				"QuasarRAT",
				"RedDelta",
				"RedLeaves",
				"Rubeus",
				"SNUGRIDE",
				"SPIVY",
				"SharpSploit",
				"SigLoader",
				"SinoChopper",
				"SodaMaster",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trochilus RAT",
				"UpperCut",
				"Vidgrab",
				"WinRAR",
				"WmiExec",
				"Wmonder",
				"Xamtrav",
				"Yggdrasil",
				"Zlib",
				"certutil",
				"certutil.exe",
				"cobeacon",
				"dfls",
				"lena",
				"nbtscan",
				"pivy",
				"poisonivy",
				"pwdump"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "8e385d36-06a2-4294-b3d3-01fe8e9d95f4",
			"created_at": "2022-10-25T16:07:24.219051Z",
			"updated_at": "2026-04-10T02:00:04.902017Z",
			"deleted_at": null,
			"main_name": "Space Pirates",
			"aliases": [
				"Erudite Mogwai",
				"Webworm"
			],
			"source_name": "ETDA:Space Pirates",
			"tools": [
				"9002 RAT",
				"Agent.dhwf",
				"AngryRebel",
				"BH_A006",
				"Chymine",
				"Darkmoon",
				"Deed RAT",
				"Destroy RAT",
				"DestroyRAT",
				"Farfli",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"HOMEUNIX",
				"HidraQ",
				"Homux",
				"Hydraq",
				"Kaba",
				"Korplug",
				"McRAT",
				"MdmBot",
				"Moudour",
				"MyKLoadClient",
				"Mydoor",
				"PCRat",
				"PCShare",
				"POISONPLUG.SHADOW",
				"PlugX",
				"Poison Ivy",
				"RedDelta",
				"Roarur",
				"SPIVY",
				"ShadowPad Winnti",
				"SnappyBee",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trochilus RAT",
				"XShellGhost",
				"Xamtrav",
				"Zupdax",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "ba3fff0c-3ba0-4855-9eeb-1af9ee18136a",
			"created_at": "2022-10-25T15:50:23.298889Z",
			"updated_at": "2026-04-10T02:00:05.316886Z",
			"deleted_at": null,
			"main_name": "menuPass",
			"aliases": [
				"menuPass",
				"POTASSIUM",
				"Stone Panda",
				"APT10",
				"Red Apollo",
				"CVNX",
				"HOGFISH",
				"BRONZE RIVERSIDE"
			],
			"source_name": "MITRE:menuPass",
			"tools": [
				"certutil",
				"FYAnti",
				"UPPERCUT",
				"SNUGRIDE",
				"P8RAT",
				"RedLeaves",
				"SodaMaster",
				"pwdump",
				"Mimikatz",
				"PlugX",
				"PowerSploit",
				"ChChes",
				"cmd",
				"QuasarRAT",
				"AdFind",
				"Cobalt Strike",
				"PoisonIvy",
				"EvilGrab",
				"esentutl",
				"Impacket",
				"Ecipekac",
				"PsExec",
				"HUI Loader"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "2664d6f5-f918-4978-87f8-f6afad7402c6",
			"created_at": "2023-01-06T13:46:39.393669Z",
			"updated_at": "2026-04-10T02:00:03.312065Z",
			"deleted_at": null,
			"main_name": "Earth Berberoka",
			"aliases": [
				"GamblingPuppet"
			],
			"source_name": "MISPGALAXY:Earth Berberoka",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "74d9dada-0106-414a-8bb9-b0d527db7756",
			"created_at": "2025-08-07T02:03:24.69718Z",
			"updated_at": "2026-04-10T02:00:03.733346Z",
			"deleted_at": null,
			"main_name": "BRONZE VINEWOOD",
			"aliases": [
				"APT31 ",
				"BRONZE EXPRESS ",
				"Judgment Panda ",
				"Red Keres",
				"TA412",
				"VINEWOOD ",
				"Violet Typhoon ",
				"ZIRCONIUM "
			],
			"source_name": "Secureworks:BRONZE VINEWOOD",
			"tools": [
				"DropboxAES RAT",
				"HanaLoader",
				"Metasploit",
				"Mimikatz",
				"Reverse ICMP shell",
				"Trochilus"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "dc7ee503-9494-4fb6-a678-440c68fd31d8",
			"created_at": "2022-10-25T16:07:23.349177Z",
			"updated_at": "2026-04-10T02:00:04.552639Z",
			"deleted_at": null,
			"main_name": "APT 31",
			"aliases": [
				"APT 31",
				"Bronze Vinewood",
				"G0128",
				"Judgment Panda",
				"Red Keres",
				"RedBravo",
				"TA412",
				"Violet Typhoon",
				"Zirconium"
			],
			"source_name": "ETDA:APT 31",
			"tools": [
				"9002 RAT",
				"Agent.dhwf",
				"AngryRebel",
				"CHINACHOPPER",
				"China Chopper",
				"Destroy RAT",
				"DestroyRAT",
				"Farfli",
				"Gh0st RAT",
				"Ghost RAT",
				"GrewApacha",
				"HOMEUNIX",
				"HiKit",
				"HidraQ",
				"Homux",
				"Hydraq",
				"Kaba",
				"Korplug",
				"McRAT",
				"MdmBot",
				"Moudour",
				"Mydoor",
				"PCRat",
				"PlugX",
				"RedDelta",
				"Roarur",
				"Sakula",
				"Sakula RAT",
				"Sakurel",
				"SinoChopper",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Trochilus RAT",
				"Xamtrav"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434682,
	"ts_updated_at": 1775792242,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ada4940c7507dd29e7e758ef3ae83207409dd47c.pdf",
		"text": "https://archive.orkl.eu/ada4940c7507dd29e7e758ef3ae83207409dd47c.txt",
		"img": "https://archive.orkl.eu/ada4940c7507dd29e7e758ef3ae83207409dd47c.jpg"
	}
}