TA581
TA581 is a newly classified threat actor tracked by Proofpoint since mid-2022 and officially designated in March 2023. Proofpoint describes TA581 as using the Forked IcedID variant and notes that the actor appears to function as an initial access facilitator or distributor. Proofpoint observed TA581 distributing the Forked IcedID variant beginning in February 2023, including campaigns using invoice-themed lures with Microsoft OneNote (.one) attachments and recall/FDA-themed lures with .URL attachments. In these campaigns, the infection chain used concealed HTA content, PowerShell, BAT execution, and rundll32 with the non-standard export "PluginInit" to execute the loader. Supporting reporting states that TA581 campaign IDs had no unique patterns, which supports the suspicion that the actor is solely a distributor or overlaps with another threat group. The content also links TA581 to distribution of the new Forked IcedID variant, which Proofpoint assessed was a modified or forked codebase rather than a direct upgrade of Standard IcedID. No additional aliases or sub-groups are provided beyond TA581.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an IcedID-associated activity cluster; lack of unique campaign-ID patterns suggests it may be primarily a distributor or overlapping with another group. No additional operational details provided in this content.
Threat actor referenced in the IcedID campaign-ID attribution analysis; suspected to be primarily a distributor or to overlap with another threat group.
Initial access facilitator distributing the Forked IcedID variant (and sometimes Bumblebee/TOAD), using business-themed lures and varied attachment types; linked to large-scale email campaigns delivering IcedID via OneNote/HTA/PowerShell chains.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.