Mealybug

TA542, also known as Mealybug and MUMMY SPIDER, is a long-running financially motivated cybercrime threat actor best known for operating Emotet. Active since at least 2014, the group initially used Emotet as a banking trojan targeting banking customers in Europe, particularly Germany and later Switzerland, before evolving it into a modular malware platform and large-scale malware delivery service for other criminal actors. TA542’s operations center on malicious email campaigns for initial access, including weaponized Office documents, links to downloader content, password-protected archives, thread-hijacking and reply-chain lures, and later alternative attachment formats such as LNK, XLL, OneNote, and App Installer-based delivery chains. Emotet has been used to establish persistence, collect host information, steal credentials and other sensitive data, exfiltrate victim information, send spam from compromised systems, and propagate laterally inside networks through brute-force activity and worm-like spread. The malware has also incorporated anti-analysis and defense-evasion features, including obfuscation, environment checks, control-flow flattening, randomization, and encrypted command-and-control communications. The group has repeatedly used Emotet to deliver additional malware for downstream monetization, including IcedID, TrickBot, Qakbot, Gootkit, and ransomware such as UmbreCrypt. Reporting has characterized TA542 as an end-to-end malware delivery service that likely profits by enabling follow-on intrusions by other threat actors rather than exclusively operating all secondary payloads itself. Post-compromise activity associated with Emotet infections has included credential theft, email account theft, browser data theft, theft of stored payment card data, spambot operations, and deployment of post-exploitation tooling such as Cobalt Strike. TA542 resumed operations in late 2021 after an international law-enforcement disruption earlier that year and subsequently updated Emotet with 64-bit modules, elliptic-curve cryptography, enhanced obfuscation, and expanded information-stealing modules. The actor has targeted both individuals and organizations globally, with observed activity affecting North America, Europe, Asia, and Africa. Its campaigns have had significant operational impact on victims because of rapid internal spread, account lockouts, follow-on malware delivery, and broad disruption to enterprise environments.