Loading threat actor…
TA2101 is a cybercriminal threat actor tracked for malspam campaigns observed in 2019 that targeted organizations in Germany, Italy, and the United States. The actor is notable for impersonating trusted entities, including government tax authorities and major service brands, to deliver malware through socially engineered email lures. Observed themes included German tax refund notices, Italian tax enforcement notifications, German telecommunications-related messages, and U.S. postal delivery notices. TA2101’s infection chains relied on malicious Microsoft Word attachments that required victims to enable macros. Once enabled, the documents launched PowerShell to retrieve and install follow-on payloads. Payloads attributed to TA2101 included Maze ransomware, Cobalt Strike, and the IcedID banking Trojan, indicating operational flexibility in malware delivery depending on campaign and target region. The actor’s campaigns showed consistent tradecraft across multiple operations, including use of lookalike domains, stolen branding, recurring URL construction patterns, and repeated infrastructure-registration artifacts. These shared tactics supported high-confidence clustering of the campaigns to a single actor. Proofpoint identified TA2101 as a Maze affiliate based on these operations, linking the actor to ransomware delivery activity as well as broader financially motivated malware distribution. TA2101 primarily targeted business organizations, with reporting specifically noting IT services companies in Germany, manufacturing companies in Italy, and heavy targeting of the healthcare sector in the United States. The actor’s observed behavior demonstrates initial access via phishing, credential-themed and authority-themed spoofing, malware delivery, and ransomware deployment. TA2101 is best understood as a financially motivated cybercriminal actor associated with Maze affiliate activity rather than a nation-state intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed only as a source/reference, not discussed as part of the event itself.
An identified affiliate associated with Maze-linked activity, known for malspam campaigns impersonating government agencies; referenced as a potential actor to impersonate Allied Universal in spam using stolen certificates.
Conducted email-based malware delivery campaigns in Germany, Italy, and the United States using government and brand impersonation lures to distribute Cobalt Strike, Maze, and IcedID.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.