{
	"id": "1bbc4587-aafb-4c78-9095-21ea8c9c8bac",
	"created_at": "2026-04-06T01:32:10.689809Z",
	"updated_at": "2026-04-10T03:36:17.233114Z",
	"deleted_at": null,
	"sha1_hash": "d998f93c9a4bdebf7f1264d2af87ec3a7bf3e738",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48000,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 00:56:48 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Spellbinder\n Tool: Spellbinder\nNames Spellbinder\nCategory Malware\nType Backdoor, Tunneling, Downloader\nDescription\n(ESET) Spellbinder enables adversary-in-the-middle (AitM) attacks, through IPv6 stateless\naddress autoconfiguration (SLAAC) spoofing, to move laterally in the compromised network,\nintercepting packets and redirecting the traffic of legitimate Chinese software so that it\ndownloads malicious updates from a server controlled by the attackers.\nInformation\nLast change to this tool card: 27 June 2025\nDownload this tool card in JSON format\nAll groups using tool Spellbinder\nChanged Name Country Observed\nAPT groups\n TheWizards 2022\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=704eb26c-c472-45dc-97cd-985f3153dc6c\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=704eb26c-c472-45dc-97cd-985f3153dc6c\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=704eb26c-c472-45dc-97cd-985f3153dc6c"
	],
	"report_names": [
		"listgroups.cgi?u=704eb26c-c472-45dc-97cd-985f3153dc6c"
	],
	"threat_actors": [
		{
			"id": "86adb59b-9acc-4dac-b7f1-7ac9214c4b97",
			"created_at": "2025-06-29T02:01:57.19934Z",
			"updated_at": "2026-04-10T02:00:04.936171Z",
			"deleted_at": null,
			"main_name": "TheWizards",
			"aliases": [],
			"source_name": "ETDA:TheWizards",
			"tools": [
				"Spellbinder",
				"WizardNet"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "06f59286-7fc1-4cae-8088-a26543643247",
			"created_at": "2025-11-07T02:00:03.494055Z",
			"updated_at": "2026-04-10T02:00:03.893442Z",
			"deleted_at": null,
			"main_name": "TheWizards",
			"aliases": [],
			"source_name": "MISPGALAXY:TheWizards",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775439130,
	"ts_updated_at": 1775792177,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d998f93c9a4bdebf7f1264d2af87ec3a7bf3e738.pdf",
		"text": "https://archive.orkl.eu/d998f93c9a4bdebf7f1264d2af87ec3a7bf3e738.txt",
		"img": "https://archive.orkl.eu/d998f93c9a4bdebf7f1264d2af87ec3a7bf3e738.jpg"
	}
}