Loading threat actor…
TaxOff, also tracked as Team46, is a cyberespionage threat cluster assessed to target Russian organizations through phishing-led intrusions and selective use of browser zero-days. The activity has been linked to campaigns from at least 2024 through 2025 and is associated with the Trinper backdoor. Reported targeting includes Russian government agencies and critical infrastructure-related organizations, with lures themed around legal matters, finance, telecommunications notices, and invitations to prominent policy or geopolitical events. The actor’s operations rely heavily on social engineering for initial access, typically using malicious links or archives containing shortcut files that launch PowerShell-based download-and-execute chains. In multiple campaigns, the actor used staged delivery with decoy documents followed by retrieval of payloads tailored to the victim host. Tradecraft attributed to this cluster includes exploitation of Google Chrome zero-day CVE-2025-2783 for one-click compromise and earlier abuse of a Yandex Browser DLL hijacking vulnerability, as well as DLL sideloading or hijacking using legitimate Windows binaries to launch malware. Trinper is the malware family most closely associated with TaxOff. It is described as a multithreaded C++ backdoor capable of command execution, reverse shell functionality, keystroke logging, and targeted file collection and exfiltration. Intrusion chains linked to the actor have also used loaders such as Donut and Cobalt Strike to stage or inject payloads. Analysts have noted overlaps between TaxOff and Team46 in phishing themes, infrastructure patterns, PowerShell tradecraft, payload delivery logic, and loader behavior, and the two names are widely treated as the same adversary or a single closely related activity cluster. The actor’s behavior is consistent with a persistent espionage-oriented operation focused on stealthy access, long-term footholds, and collection from selected Russian targets rather than financially motivated ransomware or disruptive crime.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
A Chrome zero-day (CVE-2025-2783) got some action in March when a threaet actor named TaxOff used it to drop their Trinper backdoor.
...they previously exploited a Yandex Browser DLL hijacking vulnerability (CVE-2024-6473) in a rail freight industry attack.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploited Chrome zero-day CVE-2025-2783 to deploy Trinper backdoor.
Exploited zero-day vulnerabilities in browsers to target Russian organizations with backdoors.
Runs phishing-led intrusion campaigns leveraging a Chrome sandbox-escape zero-day to deploy the Trinper backdoor for stealthy persistence, data theft, and remote command execution; uses finance-themed and geopolitical lures and an operation dubbed “ForumTroll.”
Cluster targeting Russian victims with TTPs similar to TaxOff, including willingness to use/burn zero-days; potentially the same actor as TaxOff per analyst assessment in the text.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.