Threat actor

TA429

Updated 5 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware3Families

ATT&CK3Techniques

IOCs3Tracked

Motivation: —

Also known asta429ta429_(apt10)

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Operational profile

Targeting

Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.

Where they target

Geographies tied to known operations.

Japan

MITRE ATT&CK

Tradecraft

3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

2 of 15 tactics4 techniques

= intelligence reports citing the technique

TA0001Initial Access1 technique

T1566Phishing

T1566.001Spearphishing Attachment

TA0002Execution1 technique

T1059Command and Scripting Interpreter

T1059.005Visual Basic

Malware

Associated malware families

3 malware families Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

FlowCloudProofpoint researchers identified a new, additional malware family named FlowCloud that was also being delivered to U.S. utilities providers. FlowCloud malware, like LookBack, gives attackers complete control over a compromised system.1May 25, 2026 LookBackProofpoint researchers reported that LookBack malware was targeting the United States (U.S.) utilities sector between July and August 2019... both LookBack and FlowCloud malware can be attributed to a single threat actor we are calling TA410.1May 25, 2026 QuasarRATThe blog claims that this URL delivered a modified Quasar RAT payload which included the addition of SharpSploit, an opensource post-exploitation tool.1May 25, 2026

Indicators of compromise

Observables

3 indicators attributed to this actor. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

proofpoint threat insight blogNews · Jun 8, 2020TA410: The Group Behind LookBack Attacks Against U.S. Utilities Sector Returns with New MalwareReferenced as a distinct actor whose delivery macros and infrastructure overlapped with TA410 activity. Proofpoint notes similarities in attachment macros and infrastructure, but does not attribute the LookBack and FlowCloud campaigns to TA429/APT10 and suggests the overlap may be false-flag activity.Read more ↗

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping3MITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware3Families linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables3Domains, IPs, and hashes tied to this actor, refreshed continuously.

Threat actor

TA429

Updated 5 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware3Families

ATT&CK3Techniques

IOCs3Tracked

Motivation: —

Also known asta429ta429_(apt10)

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Operational profile

Targeting

Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.

Where they target

Geographies tied to known operations.

Japan

MITRE ATT&CK

Tradecraft

3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

2 of 15 tactics4 techniques

= intelligence reports citing the technique

TA0001Initial Access1 technique

T1566Phishing

T1566.001Spearphishing Attachment

TA0002Execution1 technique

T1059Command and Scripting Interpreter

T1059.005Visual Basic

Malware

Associated malware families

3 malware families Mallory has associated with this actor across public reporting.

FamilyContextEvidenceLast seen

Indicators of compromise

Observables

3 indicators attributed to this actor. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping3MITRE ATT&CK techniques reported for this actor, grouped by tactic.

Associated malware3Families linked to this actor, with IOCs and behavior.

Associated CVEsCVEs linked to this actor, with the reporting behind each link.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables3Domains, IPs, and hashes tied to this actor, refreshed continuously.