TA542
TA542, also known as Mummy Spider, is a prolific cybercrime threat actor associated with the development, distribution, and operation of the Emotet botnet (also referred to as Geodo). Reporting in the provided content states Proofpoint has tracked TA542 since 2014, with large-scale international malspam campaigns often sending hundreds of thousands to millions of messages per campaign. The actor has targeted organizations and users across North America, Central America, South America, Europe, Asia, and Australia, with frequent targeting of Germany, the United Kingdom, the United States, Latin America, Japan, and other regions, and no clear industry-specific targeting noted in some periods. TA542 relies heavily on email-based delivery and social engineering. Observed tactics include high-volume malicious email campaigns, thread hijacking, localized language lures, invoice/payment/business-themed messages, COVID-19 themes, brand impersonation, malicious Microsoft Word documents with macros, PDFs linking to macro-enabled Word documents, JScript, ZIP archives, URLs hosted on compromised sites including WordPress installations, and frequent rotation of hardcoded payload URLs. The content also notes recurring use of Outlook address book and email harvesting capabilities, credential theft from browsers and mail clients, and a network spreader module for lateral movement. The content describes Emotet as having evolved from a banking trojan into a modular malware platform and botnet used for spam distribution, credential theft, email harvesting, and delivery of additional malware. TA542 has been observed delivering follow-on payloads including Qbot, TrickBot, IcedID, Gootkit, Zeus Panda, and, in one report, Bumblebee. CrowdStrike reporting cited in the content states that by mid-2017 Emotet was downloading other trojans including QakBot and Dridex, suggesting Mummy Spider was operating a pay-per-install loader service for other criminal groups. Proofpoint also observed IcedID Lite distributed as a follow-on payload in a TA542 Emotet campaign in November 2022. The provided content identifies Mummy Spider/TA542 as a Russian-aligned cybercrime group in Five Eyes reporting. It does not describe TA542 as a state-sponsored actor. The aliases directly supported by the content are TA542 and Mummy Spider.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Banks
- Consumer Discretionary Distribution & Retail
- Health Care Equipment & Services
- Academia & Research
- Government & Administration
- Software & Services
Where they're from
Attributed origin per open-source reporting.
- RU
Tradecraft
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Observables
111 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with Emotet campaigns that delivered IcedID Lite as a follow-on payload; Proofpoint notes limited visibility into follow-on payload attribution.
TA542 is responsible for distributing Emotet malware via large-scale email campaigns, often using hijacked email threads or invoice-themed lures. They have recently resumed activity after a hiatus, updating their tactics and leveraging additional malware loaders such as IcedID and Bumblebee.
Russian cybercriminal group highlighted in the alert as part of the broader Russian cyber threat landscape.
Threat group that developed and operates the Emotet botnet; included among Russian cybercrime groups posing a threat amid the Ukraine conflict.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.