{
	"id": "fd3432e7-f200-429c-90df-8b2e5c6ad385",
	"created_at": "2026-04-06T01:30:55.921974Z",
	"updated_at": "2026-04-10T13:12:33.211174Z",
	"deleted_at": null,
	"sha1_hash": "e868a690ab3d8b3944605e34bb8ff910f6959916",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 50637,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-06 00:25:43 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Fobber\n Tool: Fobber\nNames Fobber\nCategory Malware\nType Banking trojan, Backdoor, Credential stealer\nDescription\n(GovCERT.ch) In the original sample, there was no sign of Man-in-the-Browser (MitB)\naiming to stealbanking credentials but, since the malware has the capability to update\nitself, this posibilitycan be later added by the attackers.On our analysis, apart from the\nupdate feature, we only found the form-grabbing / cookie-stealing malicious feature.\nInformation\nMalpedia AlienVault OTX Last change to this tool card: 24 May 2020\nDownload this tool card in JSON format\nAll groups using tool Fobber\nChanged Name Country Observed\nUnknown groups\n _[ Interesting malware not linked to an actor yet ]_\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4b157100-22c4-4c04-83eb-245052a43b69\nPage 1 of 2\n\n1 group listed (0 APT, 0 other, 1 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4b157100-22c4-4c04-83eb-245052a43b69\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4b157100-22c4-4c04-83eb-245052a43b69\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=4b157100-22c4-4c04-83eb-245052a43b69"
	],
	"report_names": [
		"listgroups.cgi?u=4b157100-22c4-4c04-83eb-245052a43b69"
	],
	"threat_actors": [],
	"ts_created_at": 1775439055,
	"ts_updated_at": 1775826753,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e868a690ab3d8b3944605e34bb8ff910f6959916.pdf",
		"text": "https://archive.orkl.eu/e868a690ab3d8b3944605e34bb8ff910f6959916.txt",
		"img": "https://archive.orkl.eu/e868a690ab3d8b3944605e34bb8ff910f6959916.jpg"
	}
}