TA577

TA577 is an initial access broker (IAB) and prolific malware distributor active in email-driven intrusion chains. The content describes TA577 as a prolific Qbot/Qakbot distributor prior to Qbot’s 2023 disruption and notes that TA577 campaigns have previously led to Black Basta ransomware. TA577 has also been associated with Water Curupira as an alias. Based on the provided content, TA577 has used BAT files in malware execution chains, JavaScript to execute additional malicious payloads, and LNK files to execute embedded DLLs. The content also maps TA577 to spearphishing links (T1566.002), Windows command shell execution (T1059.003), and JavaScript execution (T1059.007). The actor is described as having used Latrodectus in at least three campaigns in November 2023 before reverting to Pikabot. In mid-February, TA577 experimented with a Java Archive (JAR) dropper to deliver Pikabot; the described sample extracted an embedded DLL disguised as a PNG file to the Windows temporary directory and executed it via regsvr32.exe. The content also states that TA577 typically uses thread hijacking to deliver malware, with Qbot as a preferred payload, and that IcedID has also been observed delivered by TA577. Additional content states that TA577 has been used in campaigns associated with Latrodectus and that multiple threat actors, including TA577, have utilized Qakbot. Proofpoint reporting in the provided content states that TA577, along with TA571 and TA544, considerably decreased activity or disappeared from email campaign data since mid-2024.