Loading story…
Proofpoint reported that TA505 ran large-scale malspam campaigns delivering a new downloader called Get2, which profiled infected hosts and fetched follow-on malware including FlawedGrace, FlawedAmmyy, Snatch, and a newly identified remote access trojan, SDBbot. The activity used malicious Excel attachments and later URL-shortener links, and targeted financial institutions and other organizations across multiple countries including the United States, Canada, Germany, Greece, Singapore, Sweden, Lithuania, Georgia, and the United Arab Emirates.
SDBbot was described as a C++ RAT built from installer, loader, and bot components, with persistence mechanisms including Run keys, Image File Execution Options, and application shimming via SDB files; Proofpoint assessed that Get2's reboot behavior likely helped activate that persistence. A public GitHub project later published a Python 2.7 SDBbot unpacker capable of extracting statically linked x86 and x64 modules such as SdbInstallerDll, RegCodeLoader, RegBlob, and BotDLL, giving defenders and researchers a way to dissect packed SDBbot samples and better understand the malware's internal structure.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On October 7, 2019, TA505 used emails with Bit.ly links redirecting victims to a landing page serving a malicious Excel file named request[.]xls. Proofpoint said this was the first time it observed Get2 downloading the newly identified SDBbot RAT, primarily against U.S. companies in multiple industries.
On September 20, 2019, TA505 sent hundreds of thousands of emails with malicious Excel and ISO attachments using English and French lures. In this campaign, Get2 downloaded FlawedGrace and targeted organizations across multiple verticals in the United States and Canada.
Proofpoint first observed Get2 in a TA505 campaign on September 9, 2019, when tens of thousands of emails with malicious Excel attachments were sent using English and Greek lures. The campaign targeted financial institutions in Greece, Singapore, the United Arab Emirates, Georgia, Sweden, Lithuania, and other countries.
A GitHub repository named SDBbot Unpacker was published, providing a Python 2.7 script to unpack and dump statically linked modules from x86 and x64 SDBbot-packed samples. The repository referenced Proofpoint's reporting on TA505 distributing SDBbot and Get2.
Proofpoint published a report describing TA505's September and October 2019 campaigns, Get2 downloader behavior, and the newly identified SDBbot RAT. The report detailed SDBbot's installer, loader, RAT components, persistence methods, and C2 communications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that threat actor **TA505** launched phishing campaigns using a newly identified downloader, **AndroMut**, to deliver the **FlawedAmmyy** remote access trojan. The activity targeted recipients in **South Korea** and financial institutions in **Singapore, the UAE, and the United States**, with lures delivered through `HTM` and `HTML` attachments that either linked to malicious Office documents or directly dropped macro-enabled Word and Excel files. AndroMut was described as a **C++** downloader with anti-analysis capabilities, encrypted strings, runtime API hashing, and persistence mechanisms. Proofpoint said the malware communicated with command-and-control infrastructure over **HTTP POST**, sending **AES-256**-encrypted JSON data, and assessed it as a new malware family with limited similarities to **Andromeda** and **QtLoader** while observing it used in TA505 operations to install FlawedAmmyy.
Aug 14, 2026
Proofpoint reported that threat actor **TA555** used a previously unknown downloader called **AdvisorsBot** in malicious email campaigns targeting victims with hotel, restaurant, and telecommunications-themed lures. First observed in May 2018, the malware acted as an initial payload that contacted command-and-control infrastructure over **HTTPS**, retrieved a fingerprinting module, and profiled infected systems to identify higher-value targets for follow-on compromise. Researchers said AdvisorsBot incorporated multiple anti-analysis features, including junk code, stack strings, API hashing, CRC32-based process and volume checks, virtual machine detection, and later machine SID blacklisting. Its modular design allowed operators to load DLLs or shellcode, and observed capabilities included screenshot capture, Outlook account collection, and broad host reconnaissance; by August, TA555 had also shifted to fileless shellcode execution and introduced a rewritten PowerShell/.NET variant, **PoshAdvisor**, while retaining the same command-and-control protocol and victim-fingerprinting behavior.
Aug 14, 2026
Researchers documented two financially motivated malware operations using multi-stage delivery chains built around JavaScript and **MSI** installers. One campaign linked to **QakBot** used search-engine pay-per-click malvertising and fake **TeamViewer** and **Zoom** installers, with redirect infrastructure including `acehphonnajaya.com`, `homepagego.com`, and `bobforlacitycouncil.com`, ultimately leading to an MSI payload hosted at `richtools.info` and `216.120.201.170`. Analysis of the MSI found a QakBot stager with a modified configuration-decoding and C2 parsing routine, including an added flag field in C2 entries, suggesting the operators were testing or expanding malvertising as a delivery method. Proofpoint separately tracked **TA866** in a campaign dubbed **Screentime**, targeting organizations in the United States and Germany through email attachments and URLs routed via the **404 TDS** traffic distribution system. Its infection chain also relied on a JavaScript downloader and MSI package, which installed a VBS downloader called **WasabiSeed** that maintained persistence and fetched additional payloads. TA866 distinguished itself by deploying a **Screenshotter** tool to capture victims’ desktops for manual triage before selectively delivering follow-on malware, including an AutoHotKey-based **AHK Bot** for Active Directory profiling and in-memory **Rhadamanthys Stealer**, highlighting a broader criminal trend of using staged MSI-based infections to qualify victims before deeper compromise.
Aug 15, 2026