{
	"id": "4b70cc59-85bb-41c7-8816-3ded173a13f3",
	"created_at": "2026-04-06T00:11:31.329034Z",
	"updated_at": "2026-04-10T03:26:15.769886Z",
	"deleted_at": null,
	"sha1_hash": "b501de50106a69993c104fd164e17dd3f79bb93e",
	"title": "Operation Titan Rain - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48468,
	"plain_text": "Operation Titan Rain - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 22:22:59 UTC\nHome \u003e List all groups \u003e Operation Titan Rain\n APT group: Operation Titan Rain\nNames Operation Titan Rain (US Government)\nCountry China\nSponsor State-sponsored, PLA Unit 61398\nMotivation Information theft and espionage\nFirst seen 2003\nDescription\n(Kaspersky) Hacks against the Defense Department and other U.S. agencies stretching back to 2003 were codenamed Ti\nRain by investigators. The attacks, which breachedhundreds of networks, including Departments of State, Energy and\nHomeland Security, were coordinated from Chinese computers, investigators found. Global defense contractor Lockheed\nMartin and NASA were also struck in what many experts called an attempt to glean information on U.S. systems. While\nusually difficult to locate the country of origin for such attacks, researchers were able to trace them back to the Chinese\nprovince of Guangdong. However, the individuals behind the operation remain a mystery to this day.\nObserved\nSectors: Defense, Energy, Government.\nCountries: UK, USA.\nTools used\nInformation\nLast change to this card: 02 July 2020\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2af8b84d-172a-4946-9873-8d17e028e9c9\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=2af8b84d-172a-4946-9873-8d17e028e9c9\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=2af8b84d-172a-4946-9873-8d17e028e9c9"
	],
	"report_names": [
		"showcard.cgi?u=2af8b84d-172a-4946-9873-8d17e028e9c9"
	],
	"threat_actors": [
		{
			"id": "f4782e93-7cd9-4390-bfbf-bc07a49c2951",
			"created_at": "2022-10-25T16:07:24.017265Z",
			"updated_at": "2026-04-10T02:00:04.841391Z",
			"deleted_at": null,
			"main_name": "Operation Titan Rain",
			"aliases": [],
			"source_name": "ETDA:Operation Titan Rain",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "cf7fc640-acfe-41c4-9f3d-5515d53a3ffb",
			"created_at": "2023-01-06T13:46:38.228042Z",
			"updated_at": "2026-04-10T02:00:02.883048Z",
			"deleted_at": null,
			"main_name": "APT1",
			"aliases": [
				"PLA Unit 61398",
				"Comment Crew",
				"Byzantine Candor",
				"Comment Group",
				"GIF89a",
				"Group 3",
				"TG-8223",
				"Brown Fox",
				"ShadyRAT",
				"G0006",
				"COMMENT PANDA"
			],
			"source_name": "MISPGALAXY:APT1",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434291,
	"ts_updated_at": 1775791575,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b501de50106a69993c104fd164e17dd3f79bb93e.pdf",
		"text": "https://archive.orkl.eu/b501de50106a69993c104fd164e17dd3f79bb93e.txt",
		"img": "https://archive.orkl.eu/b501de50106a69993c104fd164e17dd3f79bb93e.jpg"
	}
}