Loading threat actor…
TA2536 is a threat actor observed by Proofpoint in phishing campaigns. The provided content describes TA2536 as one of multiple actors that conducted phishing campaigns delivering Stealerium, and as one of the threat actors that has used the DTPacker malware packer/downloader since at least 2020. Proofpoint observed DTPacker associated with dozens of campaigns and multiple threat actors, including TA2536 and TA2715, and noted that the tool has been used by both APT and cybercrime actors. In these campaigns, email was a common initial infection vector, with malicious attachments leading to DTPacker execution and subsequent delivery of payloads such as information stealers and RATs. DTPacker has been used to distribute malware including Agent Tesla, Ave Maria (Warzone RAT), AsyncRAT, FormBook, and Snake Keylogger, and employs obfuscation techniques such as custom XOR routines, character code substitution, string obfuscation, junk Unicode characters, base64 encoding, and fixed decoding keys such as 'trump2020' and 'Trump2026'. The content does not provide a country attribution or additional confirmed aliases for TA2536 beyond the name itself.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
2 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
E-crime phishing campaigns delivering the Stealerium information stealer (and previously associated with Snake Keylogger), using lures impersonating charities, banks, courts, and document services.
TA2536 is one of the threat actors observed using DTPacker to distribute remote access trojans (RATs) and information stealers such as Agent Tesla, Ave Maria, AsyncRAT, and FormBook. Their campaigns have used email as an initial infection vector and have targeted multiple industries.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.