{
	"id": "9fcde033-9e6b-4a36-b53b-9a21b24292bf",
	"created_at": "2026-04-06T00:21:36.757483Z",
	"updated_at": "2026-04-10T13:11:22.3308Z",
	"deleted_at": null,
	"sha1_hash": "fc48b0d0c6a7f7a0b09c1ba1d4b7a5da6176e96d",
	"title": "Roaming Tiger - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 51550,
	"plain_text": "Roaming Tiger - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 18:07:20 UTC\nHome \u003e List all groups \u003e Roaming Tiger\n APT group: Roaming Tiger\nNames\nRoaming Tiger (ESET)\nRotten Tomato (Sophos)\nCTG-7273 (SecureWorks)\nBronze Woodland (SecureWorks)\nCountry China\nMotivation Information theft and espionage\nFirst seen 2014\nDescription\n(Palo Alto) In late 2014, ESET presented an attack campaign that had been observed\nover a period of time targeting Russia and other Russian speaking nations, dubbed\n“Roaming Tiger”. The attack was found to heavily rely on RTF exploits and at the\ntime, thought to make use of the PlugX malware family.\nObserved\nCountries: Belarus, Kazakhstan, Kyrgyzstan, Russia, Tajikistan, Ukraine,\nUzbekistan.\nTools used BBSRAT, Gh0st RAT, PlugX.\nOperations performed Aug 2015\nInformation Last change to this card: 10 August 2021\nDownload this actor card in PDF or JSON format\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=ee5e9d82-26c3-4f35-bee4-457ab5e20119\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=ee5e9d82-26c3-4f35-bee4-457ab5e20119\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=ee5e9d82-26c3-4f35-bee4-457ab5e20119"
	],
	"report_names": [
		"showcard.cgi?u=ee5e9d82-26c3-4f35-bee4-457ab5e20119"
	],
	"threat_actors": [
		{
			"id": "866c0c21-8de3-4ad5-9887-cecd44feb788",
			"created_at": "2022-10-25T16:07:24.130298Z",
			"updated_at": "2026-04-10T02:00:04.875929Z",
			"deleted_at": null,
			"main_name": "Roaming Tiger",
			"aliases": [
				"Bronze Woodland",
				"CTG-7273",
				"Rotten Tomato"
			],
			"source_name": "ETDA:Roaming Tiger",
			"tools": [
				"Agent.dhwf",
				"AngryRebel",
				"BBSRAT",
				"Destroy RAT",
				"DestroyRAT",
				"Farfli",
				"Gh0st RAT",
				"Ghost RAT",
				"Kaba",
				"Korplug",
				"Moudour",
				"Mydoor",
				"PCRat",
				"PlugX",
				"RedDelta",
				"Sogu",
				"TIGERPLUG",
				"TVT",
				"Thoper",
				"Xamtrav"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "5afe7b81-e99a-4c24-8fcc-250fb0cf40a3",
			"created_at": "2023-01-06T13:46:38.324616Z",
			"updated_at": "2026-04-10T02:00:02.928697Z",
			"deleted_at": null,
			"main_name": "Roaming Tiger",
			"aliases": [
				"BRONZE WOODLAND",
				"Rotten Tomato"
			],
			"source_name": "MISPGALAXY:Roaming Tiger",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "ee9a20b1-c6d6-42da-909d-66e7699723d1",
			"created_at": "2025-08-07T02:03:24.704306Z",
			"updated_at": "2026-04-10T02:00:03.722506Z",
			"deleted_at": null,
			"main_name": "BRONZE WOODLAND",
			"aliases": [
				"CTG-7273 ",
				"Roaming Tiger ",
				"Rotten Tomato "
			],
			"source_name": "Secureworks:BRONZE WOODLAND",
			"tools": [
				"Appat",
				"BbsRAT",
				"PlugX",
				"Zbot"
			],
			"source_id": "Secureworks",
			"reports": null
		}
	],
	"ts_created_at": 1775434896,
	"ts_updated_at": 1775826682,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/fc48b0d0c6a7f7a0b09c1ba1d4b7a5da6176e96d.pdf",
		"text": "https://archive.orkl.eu/fc48b0d0c6a7f7a0b09c1ba1d4b7a5da6176e96d.txt",
		"img": "https://archive.orkl.eu/fc48b0d0c6a7f7a0b09c1ba1d4b7a5da6176e96d.jpg"
	}
}