{
	"id": "9e4b094e-c1ae-4f05-a325-7053d4090ee4",
	"created_at": "2026-04-06T00:11:55.517317Z",
	"updated_at": "2026-04-10T03:23:57.226259Z",
	"deleted_at": null,
	"sha1_hash": "df6ecd1529395672f0b6331c4bb277df16a24576",
	"title": "SunCrypt Gang - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48074,
	"plain_text": "SunCrypt Gang - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 13:35:13 UTC\nHome \u003e List all groups \u003e SunCrypt Gang\n APT group: SunCrypt Gang\nNames SunCrypt Gang (?)\nCountry [Unknown]\nMotivation Financial gain\nFirst seen 2019\nDescription\n(Acronis) This ransomware family was first spotted in October 2019, but it was not\nvery active at that time. The group behind it was independent in the beginning, but\nthey recently joined the so-called Maze cartel – combining forces to rob individuals\nand companies around the world.\nObserved\nTools used SunCrypt, WARPRISM.\nOperations performed\nMay 2020\nMU Health Care Phishing Attack Impacts 5,000 Patients\nAug 2020\nSunCrypt Ransomware shuts down North Carolina school district\nAug 2020\nSunCrypt Ransomware sheds light on the Maze ransomware cartel\nSep 2020\nUniversity Hospital New Jersey hit by SunCrypt ransomware, data\nleaked\nSep 2020 Ransomware gangs add DDoS attacks to their extortion arsenal\n\ngangs-add-ddos-attacks-to-their-extortion-arsenal/\u003e\nOct 2020\nRansomware gang attacks Texas unit of global steel conglomerate\nInformation\nLast change to this card: 15 May 2021\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e2ecfc72-93c2-4b6c-8edc-001b2b87261b\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=e2ecfc72-93c2-4b6c-8edc-001b2b87261b\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=e2ecfc72-93c2-4b6c-8edc-001b2b87261b"
	],
	"report_names": [
		"showcard.cgi?u=e2ecfc72-93c2-4b6c-8edc-001b2b87261b"
	],
	"threat_actors": [
		{
			"id": "1df26eff-cd77-48dc-9425-95a4ec34bebe",
			"created_at": "2022-10-25T16:07:24.24501Z",
			"updated_at": "2026-04-10T02:00:04.9102Z",
			"deleted_at": null,
			"main_name": "SunCrypt Gang",
			"aliases": [],
			"source_name": "ETDA:SunCrypt Gang",
			"tools": [
				"SunCrypt",
				"WARPRISM"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434315,
	"ts_updated_at": 1775791437,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/df6ecd1529395672f0b6331c4bb277df16a24576.pdf",
		"text": "https://archive.orkl.eu/df6ecd1529395672f0b6331c4bb277df16a24576.txt",
		"img": "https://archive.orkl.eu/df6ecd1529395672f0b6331c4bb277df16a24576.jpg"
	}
}