{
	"id": "3a8e7a9a-2ba1-4c01-b517-dad0a62111d1",
	"created_at": "2026-04-06T00:07:00.00242Z",
	"updated_at": "2026-04-10T03:38:03.471228Z",
	"deleted_at": null,
	"sha1_hash": "d6f555c1e7f706afa254e321166be84d6cbb3fa3",
	"title": "Subgroup: Pat Bear, APT-C-37 - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51495,
	"plain_text": "Subgroup: Pat Bear, APT-C-37 - Threat Group Cards: A Threat\r\nActor Encyclopedia\r\nArchived: 2026-04-02 11:25:15 UTC\r\nHome \u003e List all groups \u003e Subgroup: Pat Bear, APT-C-37\r\n APT group: Subgroup: Pat Bear, APT-C-37\r\nNames\r\nPat Bear (Qihoo 360)\r\nAPT-C-37 (Qihoo 360)\r\nRacquet Bear (CrowdStrike)\r\nCountry Syria\r\nSponsor Syrian Electronic Army\r\nMotivation Information theft and espionage\r\nFirst seen 2015\r\nDescription\r\nA subgroup of Syrian Electronic Army (SEA), Deadeye Jackal.\r\n(Qihoo 360) Since October 2015, the Pat Bear Organization (APT-C-37) has launched a well-organized, targeted and persistent attack against the “Islamic State”. Watering hole was used to\r\ndelivery sample in this attack. The malicious samples were mainly disguised as chat software\r\nand some common software in specific fields. This Trojan has many functions such as stealing\r\nmessages, contacts, WhatsApp and Telegram data, and uploading files using FTP. After\r\nreversing and correlation, we found that there is a strong correlation between the Pat Bear\r\nOrganization and the Golden Rat issue, so this attack activity belongs to another branch of the\r\nSyrian Electronic Army.\r\nObserved\r\nSectors: Defense.\r\nCountries: Egypt, Israel and “Islamic State”.\r\nTools used DroidJack, H-Worm, njRAT, SpyNote RAT, SSLove RAT.\r\nInformation\r\n\u003chttp://blogs.360.cn/post/SEA_role_influence_cyberattacks.html\u003e\r\n\u003chttps://cybersecurity.att.com/blogs/labs-research/alien-labs-2019-analysis-of-threat-groups-molerats-and-apt-c-37#When:14:00:00Z\u003e\r\nLast change to this card: 01 January 2023\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=01751615-25f0-4ad7-9db9-65abe62e506a\r\nPage 1 of 2\n\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=01751615-25f0-4ad7-9db9-65abe62e506a\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=01751615-25f0-4ad7-9db9-65abe62e506a\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=01751615-25f0-4ad7-9db9-65abe62e506a"
	],
	"report_names": [
		"showcard.cgi?u=01751615-25f0-4ad7-9db9-65abe62e506a"
	],
	"threat_actors": [
		{
			"id": "2f498e6b-3f0e-4f26-8cc7-52121e675643",
			"created_at": "2023-01-06T13:46:38.447274Z",
			"updated_at": "2026-04-10T02:00:02.978901Z",
			"deleted_at": null,
			"main_name": "Deadeye Jackal",
			"aliases": [
				"SyrianElectronicArmy"
			],
			"source_name": "MISPGALAXY:Deadeye Jackal",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "0c502f6d-640d-4e69-bfb8-328ba6540d4f",
			"created_at": "2022-10-25T15:50:23.756782Z",
			"updated_at": "2026-04-10T02:00:05.324924Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"Molerats",
				"Operation Molerats",
				"Gaza Cybergang"
			],
			"source_name": "MITRE:Molerats",
			"tools": [
				"MoleNet",
				"DustySky",
				"DropBook",
				"SharpStage",
				"PoisonIvy"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "76fc6d92-0710-4640-bfa7-3000fe3940a5",
			"created_at": "2022-10-25T16:07:24.251595Z",
			"updated_at": "2026-04-10T02:00:04.911951Z",
			"deleted_at": null,
			"main_name": "Syrian Electronic Army (SEA)",
			"aliases": [
				"ATK 196",
				"Deadeye Jackal",
				"Syria Malware Team",
				"Syrian Electronic Army",
				"TAG-CT2"
			],
			"source_name": "ETDA:Syrian Electronic Army (SEA)",
			"tools": [
				"AndoServer",
				"CypherRat",
				"SLRat",
				"SandroRAT",
				"SilverHawk",
				"SpyNote",
				"SpyNote RAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "c2cc9aa5-1853-4de1-8849-cb3f28c7728e",
			"created_at": "2022-10-25T16:07:24.256045Z",
			"updated_at": "2026-04-10T02:00:04.912815Z",
			"deleted_at": null,
			"main_name": "Goldmouse",
			"aliases": [
				"APT-C-27",
				"ATK 80",
				"Golden Rat",
				"Goldmouse"
			],
			"source_name": "ETDA:Goldmouse",
			"tools": [
				"Bladabindi",
				"GoldenRAT",
				"Jorik",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "2c385a7d-0217-46d8-a451-29ac6fe58aaf",
			"created_at": "2023-01-06T13:46:38.937468Z",
			"updated_at": "2026-04-10T02:00:03.151838Z",
			"deleted_at": null,
			"main_name": "APT-C-27",
			"aliases": [
				"Golden RAT",
				"ATK80",
				"GoldMouse"
			],
			"source_name": "MISPGALAXY:APT-C-27",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "0769c188-62ce-44ee-8e9d-1067f3d3c083",
			"created_at": "2022-10-25T16:07:24.259063Z",
			"updated_at": "2026-04-10T02:00:04.913621Z",
			"deleted_at": null,
			"main_name": "Pat Bear",
			"aliases": [
				"APT-C-37",
				"Pat Bear",
				"Racquet Bear"
			],
			"source_name": "ETDA:Pat Bear",
			"tools": [
				"Bladabindi",
				"CypherRat",
				"DroidJack",
				"H-Worm",
				"H-Worm RAT",
				"Houdini",
				"Houdini RAT",
				"Hworm",
				"Iniduoh",
				"Jenxcus",
				"Jorik",
				"Kognito",
				"Njw0rm",
				"SSLove RAT",
				"SpyNote",
				"SpyNote RAT",
				"WSHRAT",
				"dinihou",
				"dunihi",
				"njRAT"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e5cad6bf-fa91-4128-ba0d-2bf3ff3c6c6b",
			"created_at": "2025-08-07T02:03:24.53077Z",
			"updated_at": "2026-04-10T02:00:03.680525Z",
			"deleted_at": null,
			"main_name": "ALUMINUM SARATOGA",
			"aliases": [
				"APT-C-23",
				"Arid Viper",
				"Desert Falcon",
				"Extreme Jackal ",
				"Gaza Cybergang",
				"Molerats ",
				"Operation DustySky ",
				"TA402"
			],
			"source_name": "Secureworks:ALUMINUM SARATOGA",
			"tools": [
				"BlackShades",
				"BrittleBush",
				"DarkComet",
				"LastConn",
				"Micropsia",
				"NimbleMamba",
				"PoisonIvy",
				"QuasarRAT",
				"XtremeRat"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "1162e0d4-b69c-423d-a4da-f3080d1d2b0c",
			"created_at": "2023-01-06T13:46:38.508262Z",
			"updated_at": "2026-04-10T02:00:03.006018Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"Gaza Cybergang",
				"Operation Molerats",
				"Extreme Jackal",
				"ALUMINUM SARATOGA",
				"G0021",
				"BLACKSTEM",
				"Gaza Hackers Team",
				"Gaza cybergang"
			],
			"source_name": "MISPGALAXY:Molerats",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "847f600c-cf90-44c0-8b39-fb0d5adfcef4",
			"created_at": "2022-10-25T16:07:23.875541Z",
			"updated_at": "2026-04-10T02:00:04.768142Z",
			"deleted_at": null,
			"main_name": "Molerats",
			"aliases": [
				"ATK 89",
				"Aluminum Saratoga",
				"Extreme Jackal",
				"G0021",
				"Gaza Cybergang",
				"Gaza Hackers Team",
				"Molerats",
				"Operation DustySky",
				"Operation DustySky Part 2",
				"Operation Molerats",
				"Operation Moonlight",
				"Operation SneakyPastes",
				"Operation TopHat",
				"TA402",
				"TAG-CT5"
			],
			"source_name": "ETDA:Molerats",
			"tools": [
				"BadPatch",
				"Bladabindi",
				"BrittleBush",
				"Chymine",
				"CinaRAT",
				"Darkmoon",
				"Downeks",
				"DropBook",
				"DustySky",
				"ExtRat",
				"Gen:Trojan.Heur.PT",
				"H-Worm",
				"H-Worm RAT",
				"Houdini",
				"Houdini RAT",
				"Hworm",
				"Iniduoh",
				"IronWind",
				"Jenxcus",
				"JhoneRAT",
				"Jorik",
				"KasperAgent",
				"Kognito",
				"LastConn",
				"Micropsia",
				"MoleNet",
				"Molerat Loader",
				"NeD Worm",
				"NimbleMamba",
				"Njw0rm",
				"Pierogi",
				"Poison Ivy",
				"Quasar RAT",
				"QuasarRAT",
				"SPIVY",
				"Scote",
				"SharpSploit",
				"SharpStage",
				"WSHRAT",
				"WelcomeChat",
				"Xtreme RAT",
				"XtremeRAT",
				"Yggdrasil",
				"dinihou",
				"dunihi",
				"njRAT",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434020,
	"ts_updated_at": 1775792283,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d6f555c1e7f706afa254e321166be84d6cbb3fa3.pdf",
		"text": "https://archive.orkl.eu/d6f555c1e7f706afa254e321166be84d6cbb3fa3.txt",
		"img": "https://archive.orkl.eu/d6f555c1e7f706afa254e321166be84d6cbb3fa3.jpg"
	}
}