{
	"id": "55dab632-d079-470c-bcdf-f054d71b4ae5",
	"created_at": "2026-04-06T00:14:40.101033Z",
	"updated_at": "2026-04-10T03:33:56.931321Z",
	"deleted_at": null,
	"sha1_hash": "ae432098da9677bdc8053b94269a70a295219488",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 44087,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 19:18:25 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Dracarys\n Tool: Dracarys\nNames Dracarys\nCategory Malware\nType Backdoor, Info stealer, Exfiltration\nDescription\n(Cyble) Dracarys Android Spyware impersonates genuine applications such as Signal,\nTelegram, WhatsApp, YouTube, and other chat applications and distributes through phishing\nsites.\nInformation Malpedia Last change to this tool card: 27 December 2022\nDownload this tool card in JSON format\nAll groups using tool Dracarys\nChanged Name Country Observed\nAPT groups\n Bitter [South Asia] 2013-Nov 2024\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=71259870-7b57-45e7-943f-480a79d48d84\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=71259870-7b57-45e7-943f-480a79d48d84\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=71259870-7b57-45e7-943f-480a79d48d84"
	],
	"report_names": [
		"listgroups.cgi?u=71259870-7b57-45e7-943f-480a79d48d84"
	],
	"threat_actors": [
		{
			"id": "655f7d0b-7ea6-4950-b272-969ab7c27a4b",
			"created_at": "2022-10-27T08:27:13.133291Z",
			"updated_at": "2026-04-10T02:00:05.315213Z",
			"deleted_at": null,
			"main_name": "BITTER",
			"aliases": [
				"T-APT-17"
			],
			"source_name": "MITRE:BITTER",
			"tools": [
				"ZxxZ"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "bf6cb670-bb69-473f-a220-97ac713fd081",
			"created_at": "2022-10-25T16:07:23.395205Z",
			"updated_at": "2026-04-10T02:00:04.578924Z",
			"deleted_at": null,
			"main_name": "Bitter",
			"aliases": [
				"G1002",
				"T-APT-17",
				"TA397"
			],
			"source_name": "ETDA:Bitter",
			"tools": [
				"Artra Downloader",
				"ArtraDownloader",
				"Bitter RAT",
				"BitterRAT",
				"Dracarys"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434480,
	"ts_updated_at": 1775792036,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/ae432098da9677bdc8053b94269a70a295219488.pdf",
		"text": "https://archive.orkl.eu/ae432098da9677bdc8053b94269a70a295219488.txt",
		"img": "https://archive.orkl.eu/ae432098da9677bdc8053b94269a70a295219488.jpg"
	}
}