TA575

TA575 is a financially motivated cybercrime threat actor and Dridex affiliate active since at least late 2020. The group is known for large-scale email campaigns that distribute malware through malicious URLs, Microsoft Office attachments, and password-protected files. Its operations commonly rely on social-engineering lures tied to invoices, payments, tax themes, government relief programs, and high-profile pop-culture events to drive victims into opening weaponized documents or submitting sensitive information. TA575 has repeatedly delivered Dridex, a banking trojan also used as a loader for follow-on compromise. Observed campaigns used Excel documents with macros to retrieve malware after user interaction. The actor has impersonated tax authorities and related entities in tax-themed phishing operations, including lures associated with U.S. government relief themes, and has also used entertainment-themed campaigns such as Squid Game impersonation to target organizations at scale. Reporting indicates these campaigns often reached thousands of recipients and affected hundreds to thousands of organizations across multiple sectors. The actor’s tradecraft includes phishing-based initial access, credential-focused social engineering, malware delivery via macro-enabled Office files, and use of legitimate cloud or content-delivery services to host payloads in order to blend malicious traffic with normal activity and reduce detection. TA575 has been associated with broad targeting across dozens of verticals, including educational institutions and organizations in manufacturing, healthcare, and energy. Because Dridex can support banking theft, information gathering, and downstream intrusion activity, TA575 is best understood as an initial-access and malware-distribution actor within the broader cybercrime ecosystem rather than a ransomware operator itself.