TA543

TA543, also known as Sagrid, is a financially motivated cybercriminal threat actor tracked by Proofpoint. It conducts high-volume malicious email campaigns with widespread, opportunistic targeting, typically sending thousands of messages to hundreds of organizations. Targeted sectors include finance, manufacturing, technology, retail, healthcare, education, and transportation. Its activity includes Ursnif campaigns against Australian users and malware distribution that enables downstream ransomware attacks. TA543 commonly uses invoice, billing-notification, and package-delivery lures, impersonating recognizable software and logistics brands. Delivery mechanisms include malicious Microsoft Office documents and links routed through traffic distribution systems such as BlackTDS and Keitaro. Infection chains have used SharePoint-hosted VBScript and Windows Script Files, sometimes with intermediate downloaders, to install JSSLoader. A historical campaign also used a compromised email-marketing service account to distribute malicious messages. TA543 has been a prominent distributor of JSSLoader, an initial-access loader that profiles infected systems, communicates with command-and-control infrastructure, establishes persistence, and executes additional payloads. Its campaigns have distributed both the original .NET implementation and a C++ rewrite observed in June 2021. TA543-delivered JSSLoader has loaded Griffon, a payload associated with FIN7. These operational relationships connect TA543 to the broader criminal access-distribution and ransomware ecosystem without establishing that it is the same actor as FIN7.