TA571Threat actor
TA571 is a spam distributor actor known for delivering a variety of malware, including DarkGate, NetSupport RAT, and information stealers. They use phishing emails with macro-enabled attachments to spread malicious PDFs containing rogue OneDrive links. TA571 has been observed using unique filtering techniques with intermediary "gates" to target specific users and bypass automated sandboxing.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1036Masquerading
“…s in ClickFix messages displayed to users, such as the phrase “Press the key combination” or “CTRL+V”, we discovered several websites masquerading as the homepage of a Google Meet video conference.”
- T1684Social Engineering
“In May 2024, a new social engineering tactic called ClickFix emerged, featuring a ClearFake cluster that the Sekoia Threat Detection & Research (TDR) team closely monitored and analysed in a private report entitled FLINT 2024-027 - New widespread ClearFake variant abuses PowerShe…”
- T1213.003Code Repositories
“…y targeted developers to spread Lumma Stealer by falsely reporting security vulnerabilities, thereby impacting thousands of public code repositories and exploiting developers’ trust in GitHub notifications.”
- T1219Remote Access Tools
“…, multiple malware distribution campaigns have leveraged the ClickFix lure to spread Windows and macOS infostealers, botnets, and remote access tools.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
ClickFix tactic: Revenge of detection – Detect Fake CAPTCHA“ClickFix is an emerging social engineering tactic first identified by Proofpoint in March 2024, used by the initial access broker TA571 in email phishing campaigns.”
-
ClickFix tactic: The Phantom Meet Infostealer Campaign“Proofpoint researchers, who named this tactic ClickFix, reported1 that the initial access broker TA571 leveraged it in email phishing campaigns since March 2024.”
Indicators in its reports
named in the reports above- process[.]pidin 1 report
- process.parent[.]pidin 1 report
- meet.googie.com-join[.]usin 1 report
- meet.google.web-join[.]comin 1 report
- meet.google.cdm-join[.]usin 1 report
- hxxps://meet.google.com-join[.]us/wmq-qcdn-orjin 1 report
- meet.google.com-join[.]usin 1 report
- hxxps://meet.google.us-join[.]com/ywk-batf-sfhin 1 report
- meet.google.us-join[.]comin 1 report
- hxxps://meet.google.us07host[.]com/coc-btru-aysin 1 report
- meet.google.us07host[.]comin 1 report
- hxxps://meet.google.webjoining[.]com/exw-jfaj-hpain 1 report
- meet.google.webjoining[.]comin 1 report
- hxxps://googiedrivers[.]com/fix-errorin 1 report
- googiedrivers[.]comin 1 report
- 92a8cc4e385f170d…bee9e3453138in 1 report
- a834be6d2bec10f3…58df183f773cin 1 report
- 2853a61188b4446b…743b1a44cbfein 1 report
- hxxp://95.182.97[.]58/84b7b6f977dd1c65.php%E2%80%9Din 1 report
- 95.182.97[.]58in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.