{
	"id": "a2849554-3668-4e61-a507-211733a55638",
	"created_at": "2026-04-06T00:21:06.267543Z",
	"updated_at": "2026-04-10T03:36:00.16582Z",
	"deleted_at": null,
	"sha1_hash": "cc39dd772f3daa5286c8da14bfcae8dc82295b3f",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 43759,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 18:25:16 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool DarkVNC\r\n Tool: DarkVNC\r\nNames DarkVNC\r\nCategory Malware\r\nType Backdoor\r\nDescription\r\n(Talos) DarkVNC attempts to connect to the C2 server using the TCP port 8080, likely to be\r\nless suspicious as this is one of the default ports for connections to HTTP proxies.\r\nInformation \u003chttps://blog.talosintelligence.com/2020/04/azorult-brings-friends-to-party.html\u003e\r\nMalpedia \u003chttps://malpedia.caad.fkie.fraunhofer.de/details/win.darkvnc\u003e\r\nLast change to this tool card: 27 December 2022\r\nDownload this tool card in JSON format\r\nAll groups using tool DarkVNC\r\nChanged Name Country Observed\r\nOther groups\r\n  TA554 [Unknown] 2017  \r\n1 group listed (0 APT, 1 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=345160e8-d7a0-482c-84da-5353ae011161\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=345160e8-d7a0-482c-84da-5353ae011161\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=345160e8-d7a0-482c-84da-5353ae011161"
	],
	"report_names": [
		"listgroups.cgi?u=345160e8-d7a0-482c-84da-5353ae011161"
	],
	"threat_actors": [
		{
			"id": "a3808e4f-c7fd-4d25-aa84-aacc27061826",
			"created_at": "2023-01-06T13:46:39.316216Z",
			"updated_at": "2026-04-10T02:00:03.285437Z",
			"deleted_at": null,
			"main_name": "TA554",
			"aliases": [
				"TH-163"
			],
			"source_name": "MISPGALAXY:TA554",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "9be98f84-4a93-41c7-90bd-3ea66ba5bfd7",
			"created_at": "2022-10-25T16:07:24.581954Z",
			"updated_at": "2026-04-10T02:00:05.040995Z",
			"deleted_at": null,
			"main_name": "TA554",
			"aliases": [
				"TH-163"
			],
			"source_name": "ETDA:TA554",
			"tools": [
				"DarkVNC",
				"Godzilla",
				"Godzilla Loader",
				"Gootkit",
				"Gootloader",
				"Gozi ISFB",
				"ISFB",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Nimnul",
				"Pandemyia",
				"PsiX",
				"PsiXBot",
				"Ramnit",
				"StarsLord",
				"Waldek",
				"Xswkit",
				"sLoad",
				"talalpek"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434866,
	"ts_updated_at": 1775792160,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/cc39dd772f3daa5286c8da14bfcae8dc82295b3f.pdf",
		"text": "https://archive.orkl.eu/cc39dd772f3daa5286c8da14bfcae8dc82295b3f.txt",
		"img": "https://archive.orkl.eu/cc39dd772f3daa5286c8da14bfcae8dc82295b3f.jpg"
	}
}