TA2536

TA2536 is a cybercrime threat actor associated with phishing campaigns that deliver commodity malware, including information stealers and remote access trojans. The actor has been observed using the DTPacker malware packer/downloader since at least 2020. In these operations, email serves as the primary initial access vector, typically through malicious attachments that lead to execution of DTPacker, which then decodes and launches follow-on payloads. Malware families delivered via DTPacker in campaigns linked to this ecosystem include Agent Tesla, Ave Maria (Warzone RAT), AsyncRAT, FormBook, Snake Keylogger, and Stealerium. TA2536’s tradecraft is consistent with financially motivated cybercrime focused on credential and information theft. The actor’s delivery chains rely on layered obfuscation and defense-evasion techniques, including custom XOR-based decoding, character-code substitution, string obfuscation, junk Unicode insertion, and staged payload retrieval. DTPacker’s dual role as both packer and downloader supports flexible post-delivery execution and complicates static analysis and detection. Campaigns associated with this tooling have affected organizations across multiple industries and involved high-volume phishing activity. TA2536 is one of multiple threat actors observed using DTPacker, indicating either shared access to a common criminal toolset or procurement through underground channels rather than exclusive actor-developed malware. Based on the available evidence, TA2536 is best characterized as a phishing-centric cybercriminal cluster specializing in malware delivery and credential-focused intrusion activity rather than a nation-state operator.