{
	"id": "a0dd4017-506d-4579-a132-20799c769d25",
	"created_at": "2026-04-06T00:21:35.563723Z",
	"updated_at": "2026-04-10T13:12:31.827457Z",
	"deleted_at": null,
	"sha1_hash": "cf36a0dd0075698e2861fdf5139b3572b903143e",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 44700,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 22:25:43 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Munchkin\n Tool: Munchkin\nNames Munchkin\nCategory Malware\nType Reconnaissance, Backdoor\nDescription\n(Palo Alto) The Munchkin utility is delivered as an ISO file, which is loaded in a newly\ninstalled instance of the VirtualBox virtualization product. This ISO file represents a\ncustomized implementation of the Alpine OS, which threat operators likely chose due to its\nsmall footprint.\nInformation Last change to this tool card: 29 November 2023\nDownload this tool card in JSON format\nAll groups using tool Munchkin\nChanged Name Country Observed\nAPT groups\n ALPHV, BlackCat Gang [Unknown] 2021-Mar 2024\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=af87ca7c-f05d-411a-bb2a-f30d9815e71c\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=af87ca7c-f05d-411a-bb2a-f30d9815e71c\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=af87ca7c-f05d-411a-bb2a-f30d9815e71c"
	],
	"report_names": [
		"listgroups.cgi?u=af87ca7c-f05d-411a-bb2a-f30d9815e71c"
	],
	"threat_actors": [
		{
			"id": "6e23ce43-e1ab-46e3-9f80-76fccf77682b",
			"created_at": "2022-10-25T16:07:23.303713Z",
			"updated_at": "2026-04-10T02:00:04.530417Z",
			"deleted_at": null,
			"main_name": "ALPHV",
			"aliases": [
				"ALPHV",
				"ALPHVM",
				"Ambitious Scorpius",
				"BlackCat Gang",
				"UNC4466"
			],
			"source_name": "ETDA:ALPHV",
			"tools": [
				"ALPHV",
				"ALPHVM",
				"BlackCat",
				"GO Simple Tunnel",
				"GOST",
				"Impacket",
				"LaZagne",
				"MEGAsync",
				"Mimikatz",
				"Munchkin",
				"Noberus",
				"PsExec",
				"Remcom",
				"RemoteCommandExecution",
				"WebBrowserPassView"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434895,
	"ts_updated_at": 1775826751,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/cf36a0dd0075698e2861fdf5139b3572b903143e.pdf",
		"text": "https://archive.orkl.eu/cf36a0dd0075698e2861fdf5139b3572b903143e.txt",
		"img": "https://archive.orkl.eu/cf36a0dd0075698e2861fdf5139b3572b903143e.jpg"
	}
}