Loading threat actor…
TA551, also known as Shathak, Gold Cabin, Monster Libra, and Mario Kart, is a financially motivated cybercrime threat actor tracked since at least 2016 and best known as a prolific malware distribution operation and initial access facilitator. The group has repeatedly used large-scale malspam and spearphishing campaigns, including thread hijacking, to deliver malicious attachments such as password-protected archives, Office documents, HTML smuggling lures, and macro-enabled files. TA551 has consistently relied on user execution and social engineering, particularly prompts to enable macros, to initiate multi-stage infection chains. TA551 has distributed a broad range of malware families over time, including IcedID, Ursnif, Valak, Qbot, Emotet, and BazarLoader. Reporting also links TA551-delivered IcedID activity to ransomware intrusion chains and follow-on operations associated with Maze, Egregor, and Nokoyawa. In these ecosystems, TA551 commonly functions as the distributor or access broker, while separate hands-on-keyboard actors conduct later-stage post-compromise activity. Observed TA551 tradecraft includes delivery of password-protected ZIP attachments, malicious Word documents with VBA macros, embedded HTA content, obfuscated script stages, use of regsvr32 for payload execution, and command execution through the Windows command shell. The actor has used HTTP for command and control and has employed encoded ASCII text in early-stage communications. TA551 has also been reported using the Sliver post-exploitation framework. Campaigns attributed to TA551 demonstrate broad geographic and industry targeting rather than a narrow vertical focus.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
13 malware families attributed to this actor across reporting.
8 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
125 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a threat actor associated with the command obfuscation technique using environment variable substrings in Windows command lines.
Listed as a threat actor associated with Windows Command Shell execution behavior relevant to this detection.
Listed in the detection annotations as a threat actor associated with EFI volume mounting / installation-related behavior.
Referenced as a threat actor associated with the Regsvr32 stealth technique (T1218.010).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.