{ "id": "fee90297-9d01-4239-abdd-6a02a5fe934a", "created_at": "2026-04-06T00:18:26.319699Z", "updated_at": "2026-04-10T13:12:43.89338Z", "deleted_at": null, "sha1_hash": "e56bc0cc7514991374f15800aed073ed6ad179e5", "title": "Threat Group Cards: A Threat Actor Encyclopedia", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 47992, "plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 20:00:25 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool XDMonitor\r\n Tool: XDMonitor\r\nNames XDMonitor\r\nCategory Malware\r\nType Reconnaissance, Backdoor, Info stealer, Exfiltration\r\nDescription\r\n(ESET) XDMonitor is intended to monitor the machine’s activity. It monitors when removable\r\ndrives are inserted by creating a new hidden window and registering it for device notification\r\n(using RegisterDeviceNotificationW and the GUID GUID_DEVINTERFACE_DISK). When a\r\nnew drive is inserted, it crawls it recursively. When a file with an interesting extension (the\r\nsame list as for XDList) is found, it encrypts it using RC4 (the hard-coded key is\r\n1234123412341234) and uploads it to the C\u0026C server.\r\nIt also takes a screenshot every minute. Unlike the screenshots taken by XDList, the image is\r\nnot encrypted and is stored in\r\n%TEMP%\\tmp%YEAR%%MONTH%%DAY%_%TICK_COUNT%.s. The screenshot is\r\nuploaded to the C\u0026C immediately after being taken.\r\nFinally, XDMonitor sends regular debug messages to the C\u0026C server.\r\nInformation \u003chttps://vblocalhost.com/uploads/VB2020-Faou-Labelle.pdf\u003e\r\nLast change to this tool card: 19 October 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool XDMonitor\r\nChanged Name Country Observed\r\nAPT groups\r\n  XDSpy [Unknown] 2011-Jul 2024  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=87dcdd53-b099-4067-ae5e-2bf242977fa0\r\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=87dcdd53-b099-4067-ae5e-2bf242977fa0\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=87dcdd53-b099-4067-ae5e-2bf242977fa0\r\nPage 2 of 2\n\nAPT groups XDSpy [Unknown] 2011-Jul 2024 \n1 group listed (1 APT, 0 other, 0 unknown) \n Page 1 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=87dcdd53-b099-4067-ae5e-2bf242977fa0" ], "report_names": [ "listgroups.cgi?u=87dcdd53-b099-4067-ae5e-2bf242977fa0" ], "threat_actors": [ { "id": "69cba9ab-de35-4103-a699-7d243bcfd196", "created_at": "2023-01-06T13:46:39.159472Z", "updated_at": "2026-04-10T02:00:03.233731Z", "deleted_at": null, "main_name": "XDSpy", "aliases": [], "source_name": "MISPGALAXY:XDSpy", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "f8dddd06-da24-4184-9e24-4c22bdd1cbbf", "created_at": "2023-01-06T13:46:38.626906Z", "updated_at": "2026-04-10T02:00:03.043681Z", "deleted_at": null, "main_name": "Tick", "aliases": [ "G0060", "Stalker Taurus", "PLA Unit 61419", "Swirl Typhoon", "Nian", "BRONZE BUTLER", "REDBALDKNIGHT", "STALKER PANDA" ], "source_name": "MISPGALAXY:Tick", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d69b3831-de95-42c9-b4b6-26232627206f", "created_at": "2022-10-25T16:07:24.429466Z", "updated_at": "2026-04-10T02:00:04.985102Z", "deleted_at": null, "main_name": "XDSpy", "aliases": [], "source_name": "ETDA:XDSpy", "tools": [ "ChromePass", "IE PassView", "MailPassView", "Network Password Recovery", "OperaPassView", "PasswordFox", "Protected Storage PassView", "XDDown", "XDList", "XDLoc", "XDMonitor", "XDPass", "XDRecon", "XDUpload" ], "source_id": "ETDA", "reports": null }, { "id": "54e55585-1025-49d2-9de8-90fc7a631f45", "created_at": "2025-08-07T02:03:24.563488Z", "updated_at": "2026-04-10T02:00:03.715427Z", "deleted_at": null, "main_name": "BRONZE BUTLER", "aliases": [ "CTG-2006 ", "Daserf", "Stalker Panda ", "Swirl Typhoon ", "Tick " ], "source_name": "Secureworks:BRONZE BUTLER", "tools": [ "ABK", "BBK", "Casper", "DGet", "Daserf", "Datper", "Ghostdown", "Gofarer", "MSGet", "Mimikatz", "Netboy", "RarStar", "Screen Capture Tool", "ShadowPad", "ShadowPy", "T-SMB", "down_new", "gsecdump" ], "source_id": "Secureworks", "reports": null }, { "id": "d4e7cd9a-2290-4f89-a645-85b9a46d004b", "created_at": "2022-10-25T16:07:23.419513Z", "updated_at": "2026-04-10T02:00:04.591062Z", "deleted_at": null, "main_name": "Bronze Butler", "aliases": [ "Bronze Butler", "CTG-2006", "G0060", "Operation ENDTRADE", "RedBaldNight", "Stalker Panda", "Stalker Taurus", "Swirl Typhoon", "TEMP.Tick", "Tick" ], "source_name": "ETDA:Bronze Butler", "tools": [ "8.t Dropper", "8.t RTF exploit builder", "8t_dropper", "9002 RAT", "AngryRebel", "Blogspot", "Daserf", "Datper", "Elirks", "Farfli", "Gh0st RAT", "Ghost RAT", "HOMEUNIX", "HidraQ", "HomamDownloader", "Homux", "Hydraq", "Lilith", "Lilith RAT", "McRAT", "MdmBot", "Mimikatz", "Minzen", "Moudour", "Muirim", "Mydoor", "Nioupale", "PCRat", "POISONPLUG.SHADOW", "Roarur", "RoyalRoad", "ShadowPad Winnti", "ShadowWali", "ShadowWalker", "SymonLoader", "WCE", "Wali", "Windows Credential Editor", "Windows Credentials Editor", "XShellGhost", "XXMM", "gsecdump", "rarstar" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434706, "ts_updated_at": 1775826763, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/e56bc0cc7514991374f15800aed073ed6ad179e5.pdf", "text": "https://archive.orkl.eu/e56bc0cc7514991374f15800aed073ed6ad179e5.txt", "img": "https://archive.orkl.eu/e56bc0cc7514991374f15800aed073ed6ad179e5.jpg" } }