{
	"id": "65d3d8ee-e9f6-4f55-97f6-368b322eb123",
	"created_at": "2026-04-06T00:07:25.33073Z",
	"updated_at": "2026-04-10T13:12:21.40323Z",
	"deleted_at": null,
	"sha1_hash": "d00790dd6355d15fac5d1ede788aa4cb1482ba55",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 46069,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 16:20:45 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool TerraWiper\n Tool: TerraWiper\nNames TerraWiper\nCategory Malware\nType Wiper\nDescription\n(QuoINT) In October 2018 while hunting for TerraCrypt variants we discovered a wiper\nmalware we dubbed TerraWiper. TerraWiper is a Master Boot Record (MBR) wiper compiled\nfrom PureBasic, and it uses a slightly different version of the obfuscator used for TerraLoader\nvariants. TerraWiper samples attempt to render a machine unbootable by zero-ing its MBR.\nTherefore, it would be possible for an infected computer to easily recover the data, or to make\nthe machine boot again by fixing its MBR.\nInformation\nLast change to this tool card: 10 July 2020\nDownload this tool card in JSON format\nAll groups using tool TerraWiper\nChanged Name Country Observed\nAPT groups\n Venom Spider, Golden Chickens 2017-Jan 2025\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=20f5dc28-f743-4940-ae85-6c77d0223dc2\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=20f5dc28-f743-4940-ae85-6c77d0223dc2\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=20f5dc28-f743-4940-ae85-6c77d0223dc2"
	],
	"report_names": [
		"listgroups.cgi?u=20f5dc28-f743-4940-ae85-6c77d0223dc2"
	],
	"threat_actors": [
		{
			"id": "f5c90ccc-0f18-4e07-a246-b62101ab2f6f",
			"created_at": "2023-01-06T13:46:38.854407Z",
			"updated_at": "2026-04-10T02:00:03.122844Z",
			"deleted_at": null,
			"main_name": "GC02",
			"aliases": [
				"Golden Chickens",
				"Golden Chickens02",
				"Golden Chickens 02"
			],
			"source_name": "MISPGALAXY:GC02",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f2fa9952-301f-4376-ac69-743d6f2bec1e",
			"created_at": "2023-01-06T13:46:39.122721Z",
			"updated_at": "2026-04-10T02:00:03.22231Z",
			"deleted_at": null,
			"main_name": "VENOM SPIDER",
			"aliases": [
				"badbullz",
				"badbullzvenom"
			],
			"source_name": "MISPGALAXY:VENOM SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "88802a4b-5b3d-42ee-99e6-8a4f5fd231f6",
			"created_at": "2023-01-06T13:46:38.851345Z",
			"updated_at": "2026-04-10T02:00:03.121861Z",
			"deleted_at": null,
			"main_name": "GC01",
			"aliases": [
				"Golden Chickens",
				"Golden Chickens01",
				"Golden Chickens 01"
			],
			"source_name": "MISPGALAXY:GC01",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "7a257844-df90-4bd4-b0f1-77d00ff82802",
			"created_at": "2022-10-25T16:07:24.376356Z",
			"updated_at": "2026-04-10T02:00:04.964565Z",
			"deleted_at": null,
			"main_name": "Venom Spider",
			"aliases": [
				"Golden Chickens",
				"TA4557",
				"Venom Spider"
			],
			"source_name": "ETDA:Venom Spider",
			"tools": [
				"More_eggs",
				"PureLocker",
				"SONE",
				"SpicyOmelette",
				"StealerOne",
				"Taurus Builder",
				"Taurus Builder Kit",
				"Taurus Loader",
				"Taurus Loader Reconnaissance Module",
				"Taurus Loader Stealer Module",
				"Taurus Loader TeamViewer Module",
				"Terra Loader",
				"TerraCrypt",
				"TerraLogger",
				"TerraPreter",
				"TerraRecon",
				"TerraStealer",
				"TerraTV",
				"TerraWiper",
				"ThreatKit",
				"VenomKit",
				"VenomLNK",
				"lite_more_eggs"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434045,
	"ts_updated_at": 1775826741,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d00790dd6355d15fac5d1ede788aa4cb1482ba55.pdf",
		"text": "https://archive.orkl.eu/d00790dd6355d15fac5d1ede788aa4cb1482ba55.txt",
		"img": "https://archive.orkl.eu/d00790dd6355d15fac5d1ede788aa4cb1482ba55.jpg"
	}
}