{
	"id": "6e4e8d1f-8a57-4a8a-9e5a-0022901e60e8",
	"created_at": "2026-04-06T00:22:15.701116Z",
	"updated_at": "2026-04-10T03:24:45.866371Z",
	"deleted_at": null,
	"sha1_hash": "e51add55410aa012d3e9c0ea0b4f2a4a05952796",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 45404,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 20:43:51 UTC\n Other threat group: Shark Spider\nNames Shark Spider (CrowdStrike)\nCountry Russia\nMotivation Financial crime\nFirst seen 2011\nDescription\n(Kaspersky) Recently Kaspersky Lab has contributed to an alliance of law\nenforcement and industry organizations, to undertake measures against the internet\ndomains and servers that form the core of an advanced cybercriminal infrastructure\nthat uses the Shylock Trojan to attack online banking systems around the globe.\nShylock is a banking Trojan that was first discovered in 2011. It utilizes man-in-the-browser attacks designed to pilfer banking login credentials from the PCs of clients\nof a predetermined list of target organizations. Most of these organizations are\nbanks, located in different countries.\nObserved\nSectors: Financial.\nCountries: Worldwide.\nTools used Shylock.\nOperations performed Jan 2013\nNew Version of Shylock Malware Spreading Through Skype\nCounter operations Jul 2014\nGlobal action targeting Shylock malware\nInformation Last change to this card: 14 April 2020\nDownload this actor card in PDF or JSON format\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=c967a0bb-d7ec-4955-83ca-8b90172ef9af\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=c967a0bb-d7ec-4955-83ca-8b90172ef9af\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=c967a0bb-d7ec-4955-83ca-8b90172ef9af\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=c967a0bb-d7ec-4955-83ca-8b90172ef9af"
	],
	"report_names": [
		"showcard.cgi?u=c967a0bb-d7ec-4955-83ca-8b90172ef9af"
	],
	"threat_actors": [
		{
			"id": "8ef9b0c2-4b2f-4991-890f-e4a661a906cc",
			"created_at": "2022-10-25T16:07:24.568124Z",
			"updated_at": "2026-04-10T02:00:05.035655Z",
			"deleted_at": null,
			"main_name": "Shark Spider",
			"aliases": [],
			"source_name": "ETDA:Shark Spider",
			"tools": [
				"Caphaw",
				"Shylock"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "725828a3-40cd-432d-aaf0-024d157efd34",
			"created_at": "2023-01-06T13:46:38.420843Z",
			"updated_at": "2026-04-10T02:00:02.967363Z",
			"deleted_at": null,
			"main_name": "SHARK SPIDER",
			"aliases": [],
			"source_name": "MISPGALAXY:SHARK SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434935,
	"ts_updated_at": 1775791485,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e51add55410aa012d3e9c0ea0b4f2a4a05952796.pdf",
		"text": "https://archive.orkl.eu/e51add55410aa012d3e9c0ea0b4f2a4a05952796.txt",
		"img": "https://archive.orkl.eu/e51add55410aa012d3e9c0ea0b4f2a4a05952796.jpg"
	}
}