{
	"id": "5c0e5f9b-9234-4367-b2fa-1244ef4ed50f",
	"created_at": "2026-04-06T00:14:55.317188Z",
	"updated_at": "2026-04-10T03:26:21.882732Z",
	"deleted_at": null,
	"sha1_hash": "cfefe4cc075908b7196653d566e6f438677dd689",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 52998,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 22:30:59 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool FunnyDream\n Tool: FunnyDream\nNames FunnyDream\nCategory Malware\nType Backdoor, Dropper, Loader, Exfiltration\nDescription\n(Bitdefender) The attackers used the backdoor prevalently as DLL files, but we observed\nan executable to be used as well. The files we found implement many persistence\nmechanisms, their droppers and loaders use many different file names for the payload,\nall of that suggesting that the backdoor is custom made.\nInformation\nMITRE ATT\u0026CK Malpedia Last change to this tool card: 30 December 2022\nDownload this tool card in JSON format\nAll groups using tool FunnyDream\nChanged Name Country Observed\nAPT groups\n FunnyDream 2018\n1 group listed (1 APT, 0 other, 0 unknown)\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=332c984a-acae-4a4f-98af-8e6f808942c7\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=332c984a-acae-4a4f-98af-8e6f808942c7\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=332c984a-acae-4a4f-98af-8e6f808942c7\r\nPage 2 of 2\n\nAPT groups  FunnyDream 2018 \n1 group listed (1 APT, 0 other, 0 unknown) \n   Page 1 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=332c984a-acae-4a4f-98af-8e6f808942c7"
	],
	"report_names": [
		"listgroups.cgi?u=332c984a-acae-4a4f-98af-8e6f808942c7"
	],
	"threat_actors": [
		{
			"id": "b98eb1ec-dc8b-4aea-b112-9e485408dd14",
			"created_at": "2022-10-25T16:07:23.649308Z",
			"updated_at": "2026-04-10T02:00:04.701157Z",
			"deleted_at": null,
			"main_name": "FunnyDream",
			"aliases": [
				"Bronze Edgewood",
				"Red Hariasa",
				"TAG-16"
			],
			"source_name": "ETDA:FunnyDream",
			"tools": [
				"Chinoxy",
				"Filepak",
				"FilepakMonitor",
				"FunnyDream",
				"Keyrecord",
				"LOLBAS",
				"LOLBins",
				"Living off the Land",
				"Md_client",
				"PCShare",
				"ScreenCap",
				"TcpBridge",
				"Tcp_transfer",
				"ccf32"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434495,
	"ts_updated_at": 1775791581,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/cfefe4cc075908b7196653d566e6f438677dd689.pdf",
		"text": "https://archive.orkl.eu/cfefe4cc075908b7196653d566e6f438677dd689.txt",
		"img": "https://archive.orkl.eu/cfefe4cc075908b7196653d566e6f438677dd689.jpg"
	}
}