{
	"id": "5bf6a23e-bfa8-4261-aa85-983906b9b778",
	"created_at": "2026-04-06T00:06:45.302634Z",
	"updated_at": "2026-04-10T03:36:11.088326Z",
	"deleted_at": null,
	"sha1_hash": "df335e9ffbf92b98cfc4ebc6e1c229b099bb5acc",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 68742,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 16:20:51 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool BazarBackdoor\n Tool: BazarBackdoor\nNames\nBazarBackdoor\nBazarLoader\nBEERBOT\nBazarCall\nKEGTAP\nTeam9Backdoor\nbazaloader\nCategory Malware\nType Backdoor, Downloader\nDescription\n(BleepingComputer) After a victim launches the downloaded file, the loader will sleep for a\nshort period of time and then connect to command and control servers to check-in and\ndownload the backdoor payload.\nTo get the address of the command and control servers, BazarLoader will use the Emercoin\ndecentralized DNS resolution service to resolve various hostnames that use the 'bazar' domain.\nThe 'bazar' domain can only be utilized on Emercoin's DNS servers, and as it is decentralized,\nit makes it difficult, if not impossible, for law enforcement to seize the hostname.\nAfter the payload is downloaded, it will be filelessly injected into the\nC:\\Windows\\system32\\svchost.exe process. Security researcher Vitali Kremez told\nBleepingComputer that this is done using the Process Hollowing and Process Doppelgänging\ntechniques.\nAfter a period of time, both Kremez and James have told BleepingComputer that the backdoor\nwill download and execute the Cobalt Strike penetration testing and post-exploitation toolkit\non the victim's machine.\nInformation https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577\nPage 1 of 3\n\nMalpedia Last change to this tool card: 18 November 2022\nDownload this tool card in JSON format\nAll groups using tool BazarBackdoor\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577\nPage 2 of 3\n\nChanged Name Country Observed\r\nAPT groups\r\n  FIN12 [Unknown] 2018  \r\n  Wizard Spider, Gold Blackburn 2014-May 2025\r\nOther groups\r\n  UNC1878 [Unknown] 2020  \r\n3 groups listed (2 APT, 1 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577"
	],
	"report_names": [
		"listgroups.cgi?u=45260893-fa7b-4738-aecd-7d6ad6cc1577"
	],
	"threat_actors": [
		{
			"id": "12211366-1f14-4eed-9d91-46b6a2ede618",
			"created_at": "2025-08-07T02:03:25.014713Z",
			"updated_at": "2026-04-10T02:00:03.624097Z",
			"deleted_at": null,
			"main_name": "GOLD ULRICK",
			"aliases": [
				"Grim Spider ",
				"UNC1878 "
			],
			"source_name": "Secureworks:GOLD ULRICK",
			"tools": [
				"Bloodhound",
				"Buer Loader",
				"Cobalt Strike",
				"Conti",
				"Diavol",
				"PowerShell Empire",
				"Ryuk",
				"SystemBC",
				"Team9 (aka BazarLoader)",
				"TrickBot"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "ab9d6b30-7c60-4d0b-8f49-e2e913c28508",
			"created_at": "2022-10-25T16:07:24.584775Z",
			"updated_at": "2026-04-10T02:00:05.042135Z",
			"deleted_at": null,
			"main_name": "UNC1878",
			"aliases": [],
			"source_name": "ETDA:UNC1878",
			"tools": [
				"Agentemis",
				"BEERBOT",
				"BazarBackdoor",
				"BazarCall",
				"BazarLoader",
				"Cobalt Strike",
				"CobaltStrike",
				"KEGTAP",
				"Ryuk",
				"Team9Backdoor",
				"bazaloader",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "f6f91e1c-9202-4497-bf22-9cd5ef477600",
			"created_at": "2023-01-06T13:46:38.86765Z",
			"updated_at": "2026-04-10T02:00:03.12735Z",
			"deleted_at": null,
			"main_name": "WIZARD SPIDER",
			"aliases": [
				"TEMP.MixMaster",
				"GOLD BLACKBURN",
				"DEV-0193",
				"UNC2053",
				"Pistachio Tempest",
				"DEV-0237",
				"Storm-0230",
				"FIN12",
				"Periwinkle Tempest",
				"Storm-0193",
				"Trickbot LLC"
			],
			"source_name": "MISPGALAXY:WIZARD SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "d1f8bd4e-bcd4-4101-9158-6158f1806b38",
			"created_at": "2023-01-06T13:46:39.487358Z",
			"updated_at": "2026-04-10T02:00:03.344509Z",
			"deleted_at": null,
			"main_name": "BazarCall",
			"aliases": [
				"BazzarCall",
				"BazaCall"
			],
			"source_name": "MISPGALAXY:BazarCall",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "bc119938-a79c-4e5f-9d4d-dc96835dfe2e",
			"created_at": "2024-06-04T02:03:07.799286Z",
			"updated_at": "2026-04-10T02:00:03.606456Z",
			"deleted_at": null,
			"main_name": "GOLD BLACKBURN",
			"aliases": [
				"ITG23 ",
				"Periwinkle Tempest ",
				"Wizard Spider "
			],
			"source_name": "Secureworks:GOLD BLACKBURN",
			"tools": [
				"BazarLoader",
				"Buer Loader",
				"Bumblebee",
				"Dyre",
				"Team9",
				"TrickBot"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "0a4f4edc-ea8c-4a30-8ded-35394e29de01",
			"created_at": "2023-01-06T13:46:39.178183Z",
			"updated_at": "2026-04-10T02:00:03.23716Z",
			"deleted_at": null,
			"main_name": "UNC1878",
			"aliases": [],
			"source_name": "MISPGALAXY:UNC1878",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "63061658-5810-4f01-9620-7eada7e9ae2e",
			"created_at": "2022-10-25T15:50:23.752974Z",
			"updated_at": "2026-04-10T02:00:05.244531Z",
			"deleted_at": null,
			"main_name": "Wizard Spider",
			"aliases": [
				"Wizard Spider",
				"UNC1878",
				"TEMP.MixMaster",
				"Grim Spider",
				"FIN12",
				"GOLD BLACKBURN",
				"ITG23",
				"Periwinkle Tempest",
				"DEV-0193"
			],
			"source_name": "MITRE:Wizard Spider",
			"tools": [
				"TrickBot",
				"AdFind",
				"BITSAdmin",
				"Bazar",
				"LaZagne",
				"Nltest",
				"GrimAgent",
				"Dyre",
				"Ryuk",
				"Conti",
				"Emotet",
				"Rubeus",
				"Mimikatz",
				"Diavol",
				"PsExec",
				"Cobalt Strike"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "a2d3f35f-3b29-4509-bff5-af2638140d39",
			"created_at": "2022-10-25T16:07:23.633982Z",
			"updated_at": "2026-04-10T02:00:04.695802Z",
			"deleted_at": null,
			"main_name": "FIN12",
			"aliases": [],
			"source_name": "ETDA:FIN12",
			"tools": [
				"Agentemis",
				"BEERBOT",
				"BazarBackdoor",
				"BazarCall",
				"BazarLoader",
				"Cobalt Strike",
				"CobaltStrike",
				"KEGTAP",
				"TSPY_TRICKLOAD",
				"Team9Backdoor",
				"The Trick",
				"TheTrick",
				"Totbrick",
				"TrickBot",
				"TrickLoader",
				"bazaloader",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e6a21528-2999-4e2e-aaf4-8b6af14e17f3",
			"created_at": "2022-10-25T16:07:24.422115Z",
			"updated_at": "2026-04-10T02:00:04.983298Z",
			"deleted_at": null,
			"main_name": "Wizard Spider",
			"aliases": [
				"DEV-0193",
				"G0102",
				"Gold Blackburn",
				"Gold Ulrick",
				"Grim Spider",
				"ITG23",
				"Operation BazaFlix",
				"Periwinkle Tempest",
				"Storm-0230",
				"TEMP.MixMaster",
				"Wizard Spider"
			],
			"source_name": "ETDA:Wizard Spider",
			"tools": [
				"AdFind",
				"Agentemis",
				"Anchor_DNS",
				"BEERBOT",
				"BazarBackdoor",
				"BazarCall",
				"BazarLoader",
				"Cobalt Strike",
				"CobaltStrike",
				"Conti",
				"Diavol",
				"Dyranges",
				"Dyre",
				"Dyreza",
				"Dyzap",
				"Gophe",
				"Invoke-SMBAutoBrute",
				"KEGTAP",
				"LaZagne",
				"LightBot",
				"PowerSploit",
				"PowerTrick",
				"PsExec",
				"Ryuk",
				"SessionGopher",
				"TSPY_TRICKLOAD",
				"Team9Backdoor",
				"The Trick",
				"TheTrick",
				"Totbrick",
				"TrickBot",
				"TrickLoader",
				"TrickMo",
				"Upatre",
				"bazaloader",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434005,
	"ts_updated_at": 1775792171,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/df335e9ffbf92b98cfc4ebc6e1c229b099bb5acc.pdf",
		"text": "https://archive.orkl.eu/df335e9ffbf92b98cfc4ebc6e1c229b099bb5acc.txt",
		"img": "https://archive.orkl.eu/df335e9ffbf92b98cfc4ebc6e1c229b099bb5acc.jpg"
	}
}