TA574

TA574 is a cybercrime threat actor focused on large-scale email-based malware distribution. It is tracked as a prolific distributor associated with broad, cross-industry phishing activity and is known for delivering ZLoader through socially engineered email campaigns. The actor has used high-volume lures themed around tax and financial matters, including impersonation of tax authorities and financial representatives, to induce recipients to open malicious spreadsheet attachments and enable macros. TA574’s operations are characterized by opportunistic targeting at scale rather than narrow victim specialization. Reported activity includes campaigns sending tens of thousands of messages and targeting organizations across multiple sectors. The actor commonly relies on malicious Office documents, especially Excel files with macros, as an initial infection vector. Observed tradecraft also includes geotargeting and user-agent checks prior to malware delivery, indicating efforts to tailor payload deployment and reduce exposure to automated analysis or unwanted regions. TA574 has been described as part of the broader criminal ecosystem of malware distributors and initial-access facilitators that deliver first-stage payloads later used for follow-on intrusion activity. In this role, the actor’s primary function is to establish footholds or deliver banking trojan and loader malware rather than to conduct final-stage ransomware deployment directly. ZLoader, one of the malware families associated with TA574, has been linked in wider criminal operations to credential theft, financial fraud, and downstream access monetization. TA574 is best understood as a financially motivated spam and malware delivery actor operating within the cybercrime affiliate landscape. No high-confidence attribution to a nation state is supported.