TA571

TA571 is a sophisticated, financially motivated cybercriminal threat actor tracked by Proofpoint as a high-volume spam distributor and initial access broker that delivers malware for cybercriminal customers. Proofpoint describes TA571 as running large-scale email campaigns and has assessed with high confidence that TA571 infections can lead to ransomware. Observed delivery activity includes high-volume malspam, thread hijacking, use of PDF attachments containing OneDrive links, and use of 404 TDS infrastructure with intermediary gates that apply IP and geo-fencing to validate targets and evade sandboxes and researchers. TA571 has also been associated with ClickFix-style social engineering and with use of fake error messages impersonating Google Chrome, Microsoft Word, and OneDrive. Malware and payloads directly mentioned in connection with TA571 include IcedID, including the Forked IcedID variant, Rhadamanthys, AsyncRAT, NetSupport, DarkGate, and PowerShell-based malware. Proofpoint first tracked Rhadamanthys in December 2022 in a campaign attributed to TA571, with post-exploitation attributed to TA866. In January 2024, Proofpoint attributed spam distribution in a campaign delivering a PDF-to-OneDrive-to-JavaScript-to-MSI/VBS chain to TA571, while post-exploitation tooling including WasabiSeed and Screenshotter was attributed to TA866. In October 2023, Proofpoint observed TA571 delivering Forked IcedID in two campaigns using thread-hijacking lures and 404 TDS URLs leading to password-protected ZIP archives containing a VBS script that launched an embedded loader via regsvr32. TA571 activity has been linked to 404 TDS. Separate reporting states Vacant Viper is known to affiliate with TA571 and that 404TDS delivered IcedID and other malware. TA571 has also been cited alongside ClearFake in reporting on social-engineering delivery of PowerShell malware and was identified as an early actor using ClickFix. Proofpoint observed TA571 decrease activity or disappear from email campaign data since mid-2024.