{
	"id": "7ad64f98-8470-48bf-988c-48c406b0ea85",
	"created_at": "2026-04-06T00:19:22.829672Z",
	"updated_at": "2026-04-10T13:12:00.42776Z",
	"deleted_at": null,
	"sha1_hash": "c208f0e57cdfaaaa9a7aa30e77d1697dc9b624eb",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43841,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 23:13:53 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool PasswordFox\r\n Tool: PasswordFox\r\nNames PasswordFox\r\nCategory Tools\r\nType Credential stealer\r\nDescription\r\nPasswordFox is a small password recovery tool that allows you to view the user names and\r\npasswords stored by Mozilla Firefox Web browser. By default, PasswordFox displays the\r\npasswords stored in your current profile, but you can easily select to watch the passwords of\r\nany other Firefox profile. For each password entry, the following information is displayed:\r\nRecord Index, Web Site, User Name, Password, User Name Field, Password Field, and the\r\nSignons filename.\r\nInformation \u003chttps://www.nirsoft.net/utils/passwordfox.html\u003e\r\nLast change to this tool card: 19 October 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool PasswordFox\r\nChanged Name Country Observed\r\nAPT groups\r\n  XDSpy [Unknown] 2011-Jul 2024  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a889edaa-e79b-4de4-9eb3-01536c2c1f22\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a889edaa-e79b-4de4-9eb3-01536c2c1f22\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=a889edaa-e79b-4de4-9eb3-01536c2c1f22"
	],
	"report_names": [
		"listgroups.cgi?u=a889edaa-e79b-4de4-9eb3-01536c2c1f22"
	],
	"threat_actors": [
		{
			"id": "69cba9ab-de35-4103-a699-7d243bcfd196",
			"created_at": "2023-01-06T13:46:39.159472Z",
			"updated_at": "2026-04-10T02:00:03.233731Z",
			"deleted_at": null,
			"main_name": "XDSpy",
			"aliases": [],
			"source_name": "MISPGALAXY:XDSpy",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d69b3831-de95-42c9-b4b6-26232627206f",
			"created_at": "2022-10-25T16:07:24.429466Z",
			"updated_at": "2026-04-10T02:00:04.985102Z",
			"deleted_at": null,
			"main_name": "XDSpy",
			"aliases": [],
			"source_name": "ETDA:XDSpy",
			"tools": [
				"ChromePass",
				"IE PassView",
				"MailPassView",
				"Network Password Recovery",
				"OperaPassView",
				"PasswordFox",
				"Protected Storage PassView",
				"XDDown",
				"XDList",
				"XDLoc",
				"XDMonitor",
				"XDPass",
				"XDRecon",
				"XDUpload"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434762,
	"ts_updated_at": 1775826720,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/c208f0e57cdfaaaa9a7aa30e77d1697dc9b624eb.pdf",
		"text": "https://archive.orkl.eu/c208f0e57cdfaaaa9a7aa30e77d1697dc9b624eb.txt",
		"img": "https://archive.orkl.eu/c208f0e57cdfaaaa9a7aa30e77d1697dc9b624eb.jpg"
	}
}