{
	"id": "a6eba500-c889-47a1-940c-bfd7807e61d3",
	"created_at": "2026-04-06T00:17:18.850486Z",
	"updated_at": "2026-04-10T13:12:51.884851Z",
	"deleted_at": null,
	"sha1_hash": "d070c4389221f820502a775c41849e5eb7d1ccbe",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 56374,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 14:10:46 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Loda\n Tool: Loda\nNames\nLoda\nLoda RAT\nLodaRAT\nNymeria\nCategory Malware\nType Backdoor\nDescription\n(Talos) Loda is a simple, yet effective, RAT that has matured over time. This RAT is a good\nexample of how effective relatively simple techniques combined with basic obfuscation can\nbe. The techniques this malware employs are of fairly low complexity and show that slight\nchanges in implementation can significantly reduce detection rates.\nInformation\nMalpedia Last change to this tool card: 28 December 2022\nDownload this tool card in JSON format\nAll groups using tool Loda\nChanged Name Country Observed\nAPT groups\n TA558 [Unknown] 2018-Jun 2023\n YoroTrooper 2022\n2 groups listed (2 APT, 0 other, 0 unknown)\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=2f870afa-6fdb-46fb-b479-df270e6d0bb7\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=2f870afa-6fdb-46fb-b479-df270e6d0bb7\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=2f870afa-6fdb-46fb-b479-df270e6d0bb7\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=2f870afa-6fdb-46fb-b479-df270e6d0bb7"
	],
	"report_names": [
		"listgroups.cgi?u=2f870afa-6fdb-46fb-b479-df270e6d0bb7"
	],
	"threat_actors": [
		{
			"id": "c416152c-d268-40a3-8887-01d2ec452b7c",
			"created_at": "2023-04-27T02:04:45.481771Z",
			"updated_at": "2026-04-10T02:00:04.987067Z",
			"deleted_at": null,
			"main_name": "YoroTrooper",
			"aliases": [
				"Silent Lynx"
			],
			"source_name": "ETDA:YoroTrooper",
			"tools": [
				"Loda",
				"Loda RAT",
				"LodaRAT",
				"Meterpreter",
				"Nymeria",
				"Warzone",
				"Warzone RAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "316b23b5-e097-4dc6-8b1c-d096860c6c16",
			"created_at": "2022-10-25T16:07:24.290801Z",
			"updated_at": "2026-04-10T02:00:04.924688Z",
			"deleted_at": null,
			"main_name": "TA558",
			"aliases": [],
			"source_name": "ETDA:TA558",
			"tools": [
				"AZORult",
				"AsyncRAT",
				"Bladabindi",
				"ExtRat",
				"Jorik",
				"Loda",
				"Loda RAT",
				"LodaRAT",
				"Nymeria",
				"PuffStealer",
				"Remcos",
				"RemcosRAT",
				"Remvio",
				"Revenge RAT",
				"RevengeRAT",
				"Revetrat",
				"Rultazo",
				"Socmer",
				"Vengeance Justice Worm",
				"Vjw0rm",
				"Xtreme RAT",
				"XtremeRAT",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "322248d6-4baf-4ada-af8e-074bc6c10132",
			"created_at": "2023-11-05T02:00:08.072145Z",
			"updated_at": "2026-04-10T02:00:03.397406Z",
			"deleted_at": null,
			"main_name": "YoroTrooper",
			"aliases": [
				"Comrade Saiga",
				"Salted Earth",
				"Sturgeon Fisher",
				"ShadowSilk",
				"Silent Lynx",
				"Cavalry Werewolf",
				"SturgeonPhisher"
			],
			"source_name": "MISPGALAXY:YoroTrooper",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "cf91b389-9602-45c0-8d6b-c61d14800f54",
			"created_at": "2023-01-06T13:46:39.448277Z",
			"updated_at": "2026-04-10T02:00:03.332604Z",
			"deleted_at": null,
			"main_name": "TA558",
			"aliases": [],
			"source_name": "MISPGALAXY:TA558",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434638,
	"ts_updated_at": 1775826771,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d070c4389221f820502a775c41849e5eb7d1ccbe.pdf",
		"text": "https://archive.orkl.eu/d070c4389221f820502a775c41849e5eb7d1ccbe.txt",
		"img": "https://archive.orkl.eu/d070c4389221f820502a775c41849e5eb7d1ccbe.jpg"
	}
}