{
	"id": "8877000d-de70-43be-a67e-374ea305b03d",
	"created_at": "2026-04-06T01:31:43.251478Z",
	"updated_at": "2026-04-10T03:21:19.04655Z",
	"deleted_at": null,
	"sha1_hash": "b1ae8a4dbd94b7345af46b7d29f24d91fb4e777c",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46265,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 00:50:41 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool FjordPhantom\n Tool: FjordPhantom\nNames FjordPhantom\nCategory Malware\nType Banking trojan\nDescription\n(Promon) Through longtime Promon partner i-Sprint, our Security Research team\nreceived reports of a new Android malware spreading in Southeast Asia in early\nSeptember, primarily Indonesia, Thailand, and Vietnam. Promon also believes that the\nmalware is active in Singapore and Malaysia. Spreading primarily through messaging\nservices, it combines app-based malware with social engineering to defraud banking\ncustomers. In discussions with banks in the region, Promon has learned that one\ncustomer was defrauded out of 10 million Thai Baht (approximately $280,000) at the\ntime of writing.\nInformation MITRE ATT\u0026CK Last change to this tool card: 28 June 2025\nDownload this tool card in JSON format\nAll groups using tool FjordPhantom\nChanged Name Country Observed\nUnknown groups\n _[ Interesting malware not linked to an actor yet ]_\n1 group listed (0 APT, 0 other, 1 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=dfe29653-32f9-4b24-badb-421f913e3936\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=dfe29653-32f9-4b24-badb-421f913e3936\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=dfe29653-32f9-4b24-badb-421f913e3936"
	],
	"report_names": [
		"listgroups.cgi?u=dfe29653-32f9-4b24-badb-421f913e3936"
	],
	"threat_actors": [],
	"ts_created_at": 1775439103,
	"ts_updated_at": 1775791279,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b1ae8a4dbd94b7345af46b7d29f24d91fb4e777c.pdf",
		"text": "https://archive.orkl.eu/b1ae8a4dbd94b7345af46b7d29f24d91fb4e777c.txt",
		"img": "https://archive.orkl.eu/b1ae8a4dbd94b7345af46b7d29f24d91fb4e777c.jpg"
	}
}