{
	"id": "4f575c65-4cfb-4a1a-a9e0-03756ed5ab8e",
	"created_at": "2026-04-06T00:21:15.438293Z",
	"updated_at": "2026-04-10T13:12:25.598298Z",
	"deleted_at": null,
	"sha1_hash": "b7818d833f28056d08b65a52be41e2f6b7c4ed5c",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43631,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 13:39:29 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Empoder\r\n Tool: Empoder\r\nNames Empoder\r\nCategory Malware\r\nType Loader\r\nDescription\r\n(Malwarebytes) Prior to using Koadic as the main RAT this actor has used EmpireProject as its\r\nmain toolset. To load PowerShell Empire the actor has used its Empire Loader which we call\r\nEmpoder.\r\nInformation \u003chttps://resources.malwarebytes.com/files/2021/02/LazyScripter.pdf\u003e\r\nLast change to this tool card: 19 April 2021\r\nDownload this tool card in JSON format\r\nAll groups using tool Empoder\r\nChanged Name Country Observed\r\nAPT groups\r\n  LazyScripter [Unknown] 2018  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4b8e3440-e43d-435f-b180-1b4e60192cc0\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4b8e3440-e43d-435f-b180-1b4e60192cc0\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4b8e3440-e43d-435f-b180-1b4e60192cc0"
	],
	"report_names": [
		"listgroups.cgi?u=4b8e3440-e43d-435f-b180-1b4e60192cc0"
	],
	"threat_actors": [
		{
			"id": "b20281dd-8cc4-4284-b85c-f98c7e09ae48",
			"created_at": "2022-10-25T15:50:23.642844Z",
			"updated_at": "2026-04-10T02:00:05.392724Z",
			"deleted_at": null,
			"main_name": "LazyScripter",
			"aliases": [
				"LazyScripter"
			],
			"source_name": "MITRE:LazyScripter",
			"tools": [
				"Remcos",
				"QuasarRAT",
				"njRAT",
				"ngrok",
				"Koadic",
				"KOCTOPUS"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "712fc9fa-4283-431b-882c-5e0de9c12452",
			"created_at": "2022-10-25T16:07:23.770209Z",
			"updated_at": "2026-04-10T02:00:04.745132Z",
			"deleted_at": null,
			"main_name": "LazyScripter",
			"aliases": [
				"G0140"
			],
			"source_name": "ETDA:LazyScripter",
			"tools": [
				"Adwind",
				"Adwind RAT",
				"Alien Spy",
				"AlienSpy",
				"Bladabindi",
				"CinaRAT",
				"EmPyre",
				"EmpireProject",
				"Empoder",
				"Frutas",
				"Gussdoor",
				"Invoke-Ngrok",
				"JBifrost RAT",
				"JSocket",
				"Jorik",
				"KOCTOPUS",
				"Koadic",
				"Luminosity RAT",
				"LuminosityLink",
				"Nishang",
				"PowerShell Empire",
				"Quasar RAT",
				"QuasarRAT",
				"Remcos",
				"RemcosRAT",
				"Remote Manipulator System",
				"Remvio",
				"RuRAT",
				"Sockrat",
				"Socmer",
				"Trojan.Maljava",
				"UnReCoM",
				"Unknown RAT",
				"Unrecom",
				"Yggdrasil",
				"jBiFrost",
				"jConnectPro RAT",
				"jFrutas",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434875,
	"ts_updated_at": 1775826745,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b7818d833f28056d08b65a52be41e2f6b7c4ed5c.pdf",
		"text": "https://archive.orkl.eu/b7818d833f28056d08b65a52be41e2f6b7c4ed5c.txt",
		"img": "https://archive.orkl.eu/b7818d833f28056d08b65a52be41e2f6b7c4ed5c.jpg"
	}
}