TA577Threat actor
- hive0118
TA577 is a prolific cybercrime threat actor tracked by Proofpoint since mid-2020. This actor conducts broad targeting across various industries and geographies, and Proofpoint has observed TA577 deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
6 of 25 · each with the sentence it comes from- T1014Rootkit
“hxxps://victorbush.com/2015/04/the-anti-rootkit-rootkit/”
- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1027Obfuscated Files or Information
“Defense EvasionT1027.007 – Obfuscated Files or Information: Dynamic API Resolution”
- T1027.006HTML Smuggling
“HTML smuggling > ZIP > JavaScript > CMD > DLL”
- T1027.007Dynamic API Resolution
“…es to evade detection and harden analysis, including system checks, indirect syscalls, encryption of next-stage and strings, and dynamic API resolution.”
- T1033System Owner/User Discovery
“DiscoveryT1033 – System Owner/User Discovery”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Threat Actors Impacting the Financial Sector in 2024“Some of the most well-documented IABs that are known for targeting financial institutions in their campaigns are TA577, TA569, TA570, Hive0145, Prophet Spider (aka UNC961 aka Gold Melody), among others.”
-
PikaBot: a Guide to its Deep Secrets and Operations“Infrastructure activity aligns closely with TA577's campaigns, which Sekoia assesses as PikaBot's primary and possibly exclusive user.”
Indicators in its reports
named in the reports above- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- 959da0fb174a8e4d…76a2f43c0f25in 1 report
- data[.]datain 1 report
- lordless[.]namein 1 report
- resonancessewars[.]tiresin 1 report
- alkaliesnonperspective[.]fishin 1 report
- demonising[.]liin 1 report
- callipersoutane[.]comin 1 report
- issuer[.]countryin 1 report
- hxxps://redops[.]at/en/blog/direct-syscalls-vs-indirect-syscallsin 1 report
- redops[.]atin 1 report
- hxxps://www.vmray[.]com/cyber-security-blog/why-your-edr-let-pikabot-jump-through/in 1 report
- www.vmray[.]comin 1 report
- hxxps://victorbush[.]com/2015/04/the-anti-rootkit-rootkit/in 1 report
- victorbush[.]comin 1 report
- hxxps://blog.krakz[.]fr/notes/syswhispers2/in 1 report
- blog.krakz[.]frin 1 report
- hxxps://medium[.]com/@DCSO_CyTec/shortandmalicious-pikabot-and-the-matanbuchus-connection-5e302644398in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.