{
	"id": "118c7d2e-ef90-49da-8a72-a189c85c50b0",
	"created_at": "2026-04-06T00:09:15.38051Z",
	"updated_at": "2026-04-10T03:21:40.477799Z",
	"deleted_at": null,
	"sha1_hash": "eff6566666f0247e8715dbca6fdcd76b8dc06795",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 50153,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 16:03:11 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool GodFather\n Tool: GodFather\nNames GodFather\nCategory Malware\nType Banking trojan, Reconnaissance, Info stealer, Credential stealer\nDescription\n(Cyble) During our routine Open-Source Intelligence (OSINT) research, Cyble Research Labs\ncame across a Twitter post wherein researchers mention an Android bankbot named GodFather\nwith the name apkversion1.1.5.43 and an icon similar to the default Settings app.\nWe found notable similarities with Cereberus and Medusa banking trojans upon analyzing the\nmalware sample. GodFather malware acts on the commands from Threat Actor’s (TA’s)\nCommand \u0026 Control (C\u0026C) server to steal sensitive information from the victim’s device.\nUpon successful execution, the malware can perform malicious activities such as transferring\nmoney, getting device information such as phone number, installed app list, battery info, etc.\nBy further abusing the permissions on the affected device, the malware can also steal SMSs,\ncontrol device screen using VNC, forward calls, and open URLs without the user’s knowledge.\nInformation\nMalpedia Last change to this tool card: 26 December 2024\nDownload this tool card in JSON format\nAll groups using tool GodFather\nChanged Name Country Observed\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=922d749e-df19-477c-a88d-c0153df75733\nPage 1 of 2\n\nUnknown groups\r\n  _[ Interesting malware not linked to an actor yet ]_  \r\n1 group listed (0 APT, 0 other, 1 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=922d749e-df19-477c-a88d-c0153df75733\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=922d749e-df19-477c-a88d-c0153df75733\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=922d749e-df19-477c-a88d-c0153df75733"
	],
	"report_names": [
		"listgroups.cgi?u=922d749e-df19-477c-a88d-c0153df75733"
	],
	"threat_actors": [],
	"ts_created_at": 1775434155,
	"ts_updated_at": 1775791300,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/eff6566666f0247e8715dbca6fdcd76b8dc06795.pdf",
		"text": "https://archive.orkl.eu/eff6566666f0247e8715dbca6fdcd76b8dc06795.txt",
		"img": "https://archive.orkl.eu/eff6566666f0247e8715dbca6fdcd76b8dc06795.jpg"
	}
}