{
  "id": "thrip",
  "name": "Thrip",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Unattributed cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as \"living off the land\" techniques.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Not attributed by ATT&CK",
      "src": [
        "mitre-g0076"
      ],
      "conf": "low"
    },
    {
      "k": "attack_id",
      "v": "G0076",
      "src": [
        "mitre-g0076"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia.",
      "src": [
        "mitre-g0076"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 4,
      "src": [
        "mitre-g0076"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Catchamas, Mimikatz, PsExec",
      "src": [
        "mitre-g0076"
      ],
      "conf": "high",
      "note": "3 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as \"living off the land\" techniques. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0076)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/thrip.html",
  "sources": {
    "mitre-g0076": {
      "title": "Thrip, Group G0076",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0076/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}