{
	"id": "4034bc20-8eab-4ac7-9539-039d642c0401",
	"created_at": "2026-04-06T00:08:12.254085Z",
	"updated_at": "2026-04-10T03:31:36.731104Z",
	"deleted_at": null,
	"sha1_hash": "e1019f9b6f467ac8f0426a079c7cd7b5bd6b8214",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 48806,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 23:42:29 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Leo RAT\r\n Tool: Leo RAT\r\nNames Leo RAT\r\nCategory Malware\r\nType Backdoor\r\nDescription\r\n(Airbus) Additionally to the Paladin RAT, we found another variant of Gh0st RAT, named “Leo”. Although we have found\r\nc\u0026c server of the group, there is no evidence that is has been used by the group, in opposition to Paladin which is used ofte\r\nPitty Tiger.\r\nInformation \u003chttps://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/2014.07.11.Pitty_Tiger/Pitty_Tiger_Final_Re\r\nLast change to this tool card: 20 April 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool Leo RAT\r\nChanged Name Country Observed\r\nAPT groups\r\n  PittyTiger, Pitty Panda 2011-2014  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=82ce1d12-9f72-4e4e-be92-c3b59ef7adac\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=82ce1d12-9f72-4e4e-be92-c3b59ef7adac\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=82ce1d12-9f72-4e4e-be92-c3b59ef7adac"
	],
	"report_names": [
		"listgroups.cgi?u=82ce1d12-9f72-4e4e-be92-c3b59ef7adac"
	],
	"threat_actors": [
		{
			"id": "1b77c737-ab1f-45e9-ae50-996741d94ab2",
			"created_at": "2022-10-25T15:50:23.842907Z",
			"updated_at": "2026-04-10T02:00:05.401907Z",
			"deleted_at": null,
			"main_name": "PittyTiger",
			"aliases": [
				"PittyTiger"
			],
			"source_name": "MITRE:PittyTiger",
			"tools": [
				"gh0st RAT",
				"Lurid",
				"gsecdump",
				"PoisonIvy",
				"Mimikatz"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "6241b9be-9c59-4164-a7f2-c45844b14a56",
			"created_at": "2023-01-06T13:46:38.321506Z",
			"updated_at": "2026-04-10T02:00:02.926657Z",
			"deleted_at": null,
			"main_name": "APT24",
			"aliases": [
				"PITTY PANDA",
				"G0011",
				"Temp.Pittytiger"
			],
			"source_name": "MISPGALAXY:APT24",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "c2ef6b18-12c4-4879-a408-be4c9b03eb6e",
			"created_at": "2022-10-25T16:07:24.055115Z",
			"updated_at": "2026-04-10T02:00:04.852387Z",
			"deleted_at": null,
			"main_name": "PittyTiger",
			"aliases": [
				"G0011",
				"Operation The Eye of the Tiger",
				"Pitty Panda",
				"PittyTiger"
			],
			"source_name": "ETDA:PittyTiger",
			"tools": [
				"AngryRebel",
				"Chymine",
				"Darkmoon",
				"Enfal",
				"Farfli",
				"Gen:Trojan.Heur.PT",
				"Gh0st RAT",
				"Ghost RAT",
				"Leo RAT",
				"Lurid",
				"Mimikatz",
				"Moudour",
				"Mydoor",
				"PCRat",
				"Paladin",
				"Paladin RAT",
				"Pitty",
				"PittyTiger RAT",
				"Poison Ivy",
				"ReRol",
				"SPIVY",
				"gsecdump",
				"pgift",
				"pivy",
				"poisonivy"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434092,
	"ts_updated_at": 1775791896,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e1019f9b6f467ac8f0426a079c7cd7b5bd6b8214.pdf",
		"text": "https://archive.orkl.eu/e1019f9b6f467ac8f0426a079c7cd7b5bd6b8214.txt",
		"img": "https://archive.orkl.eu/e1019f9b6f467ac8f0426a079c7cd7b5bd6b8214.jpg"
	}
}