{
	"id": "6dbc4a52-8d2b-489c-a29d-bad400e12ca2",
	"created_at": "2026-04-06T00:14:10.659012Z",
	"updated_at": "2026-04-10T03:30:40.741065Z",
	"deleted_at": null,
	"sha1_hash": "f43f4ba07bbcc0ca85d395e9763c4428ed646a8f",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 49408,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 13:46:48 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool PseudoManuscrypt\n Tool: PseudoManuscrypt\nNames PseudoManuscrypt\nCategory Malware\nType Backdoor\nDescription\n(Kaspersky) The PseudoManuscrypt loader makes its way onto user systems via a MaaS\nplatform that distributes malware in pirated software installer archives. One specific case of\nthe PseudoManuscrypt downloader’s distribution is its installation via the Glupteba botnet\n(whose main installer is also distributed via the pirated software installer distribution\nplatform). This means that the malware distribution tactics used by the threat actor behind\nPseudoManuscrypt demonstrate no particular targeting.\nInformation\nMalpedia Last change to this tool card: 27 December 2022\nDownload this tool card in JSON format\nAll groups using tool PseudoManuscrypt\nChanged Name Country Observed\nAPT groups\n Operation PseudoManuscrypt 2021\n1 group listed (1 APT, 0 other, 0 unknown)\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1c5630e1-74a9-42ba-b5eb-a1e024c7c250\nPage 1 of 2\n\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1c5630e1-74a9-42ba-b5eb-a1e024c7c250\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1c5630e1-74a9-42ba-b5eb-a1e024c7c250\r\nPage 2 of 2\n\nAPT groups Operation PseudoManuscrypt 2021 \n1 group listed (1 APT, 0 other, 0 unknown) \n   Page 1 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=1c5630e1-74a9-42ba-b5eb-a1e024c7c250"
	],
	"report_names": [
		"listgroups.cgi?u=1c5630e1-74a9-42ba-b5eb-a1e024c7c250"
	],
	"threat_actors": [
		{
			"id": "fdb56a20-0dc9-4cb4-9388-ae117daa595f",
			"created_at": "2022-10-25T16:07:23.993878Z",
			"updated_at": "2026-04-10T02:00:04.825976Z",
			"deleted_at": null,
			"main_name": "Operation PseudoManuscrypt",
			"aliases": [],
			"source_name": "ETDA:Operation PseudoManuscrypt",
			"tools": [
				"PseudoManuscrypt"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434450,
	"ts_updated_at": 1775791840,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/f43f4ba07bbcc0ca85d395e9763c4428ed646a8f.pdf",
		"text": "https://archive.orkl.eu/f43f4ba07bbcc0ca85d395e9763c4428ed646a8f.txt",
		"img": "https://archive.orkl.eu/f43f4ba07bbcc0ca85d395e9763c4428ed646a8f.jpg"
	}
}