TA573

TA573 is a malware distribution actor tracked as an affiliate-style distributor in email-borne cybercrime operations. It has been associated with distributing Dridex, a banking trojan and malware platform operated by Evil Corp, a Russian cybercriminal group. TA573 functions primarily as an access and payload delivery actor within a broader criminal ecosystem rather than as the developer of the malware it distributes. TA573 is linked to people-centric intrusion activity centered on malicious email delivery and social engineering. In the broader campaign environment in which it has been profiled, common tradecraft includes phishing-based initial access, malicious document and macro-enabled lures, HTML-based delivery, PowerShell-driven infection chains, password-protected payloads used to reduce detection, thread hijacking through compromised email accounts, geofencing, and sandbox-evasion techniques including abuse of legitimate Windows utilities. High-confidence attribution supports TA573 specifically as a distributor of Dridex, but not all surrounding email techniques can be uniquely assigned to TA573 alone. The actor is best understood as part of the financially motivated cybercrime affiliate ecosystem surrounding Dridex and Evil Corp. No high-confidence evidence in the available facts supports specific sub-groups, victim-country lists, or industry specialization for TA573 itself.