Loading story…
Proofpoint reported that threat actor TA555 used a previously unknown downloader called AdvisorsBot in malicious email campaigns targeting victims with hotel, restaurant, and telecommunications-themed lures. First observed in May 2018, the malware acted as an initial payload that contacted command-and-control infrastructure over HTTPS, retrieved a fingerprinting module, and profiled infected systems to identify higher-value targets for follow-on compromise.
Researchers said AdvisorsBot incorporated multiple anti-analysis features, including junk code, stack strings, API hashing, CRC32-based process and volume checks, virtual machine detection, and later machine SID blacklisting. Its modular design allowed operators to load DLLs or shellcode, and observed capabilities included screenshot capture, Outlook account collection, and broad host reconnaissance; by August, TA555 had also shifted to fileless shellcode execution and introduced a rewritten PowerShell/.NET variant, PoshAdvisor, while retaining the same command-and-control protocol and victim-fingerprinting behavior.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On August 15, the actor changed tactics again and delivered a PowerShell version of AdvisorsBot called PoshAdvisor. Proofpoint said the new variant preserved the same command-and-control protocol and fingerprinting behavior as AdvisorsBot.
In an August 8 campaign, the macro executed PowerShell that downloaded another PowerShell script, which ran embedded shellcode to execute AdvisorsBot without writing it to disk. The same version also added a machine SID blacklist anti-analysis check.
In the May and June 2018 campaigns, malicious documents used macros to execute PowerShell that downloaded and ran AdvisorsBot. This established the initial observed delivery chain for the malware family.
Proofpoint researchers first observed the previously undocumented AdvisorsBot downloader in malicious email campaigns beginning in May 2018. The campaigns used themed lures and primarily targeted hotel, restaurant, and telecommunications organizations.
Proofpoint documented AdvisorsBot as a previously unknown downloader malware family distributed by TA555 and described its anti-analysis, command-and-control, and fingerprinting-module behavior. The report also published indicators including command-and-control domains and IP addresses tied to the campaigns.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that threat actor **TA505** launched phishing campaigns using a newly identified downloader, **AndroMut**, to deliver the **FlawedAmmyy** remote access trojan. The activity targeted recipients in **South Korea** and financial institutions in **Singapore, the UAE, and the United States**, with lures delivered through `HTM` and `HTML` attachments that either linked to malicious Office documents or directly dropped macro-enabled Word and Excel files. AndroMut was described as a **C++** downloader with anti-analysis capabilities, encrypted strings, runtime API hashing, and persistence mechanisms. Proofpoint said the malware communicated with command-and-control infrastructure over **HTTP POST**, sending **AES-256**-encrypted JSON data, and assessed it as a new malware family with limited similarities to **Andromeda** and **QtLoader** while observing it used in TA505 operations to install FlawedAmmyy.
Aug 14, 2026
Proofpoint reported that **TA505** ran large-scale malspam campaigns delivering a new downloader called **Get2**, which profiled infected hosts and fetched follow-on malware including **FlawedGrace**, **FlawedAmmyy**, **Snatch**, and a newly identified remote access trojan, **SDBbot**. The activity used malicious Excel attachments and later URL-shortener links, and targeted financial institutions and other organizations across multiple countries including the United States, Canada, Germany, Greece, Singapore, Sweden, Lithuania, Georgia, and the United Arab Emirates. SDBbot was described as a C++ RAT built from installer, loader, and bot components, with persistence mechanisms including **Run keys**, **Image File Execution Options**, and **application shimming via SDB files**; Proofpoint assessed that Get2's reboot behavior likely helped activate that persistence. A public GitHub project later published a Python 2.7 **SDBbot unpacker** capable of extracting statically linked x86 and x64 modules such as `SdbInstallerDll`, `RegCodeLoader`, `RegBlob`, and `BotDLL`, giving defenders and researchers a way to dissect packed SDBbot samples and better understand the malware's internal structure.
Aug 15, 2026
Proofpoint reported that **TA584**, a high-volume **initial access broker (IAB)** tracked since 2020, significantly increased operational tempo in 2025 and introduced multiple attack-chain changes, including expanded global targeting, adoption of **ClickFix** social engineering, and delivery of a newer malware family dubbed **Tsundere Bot**. Proofpoint assessed that TA584’s rapid campaign iteration and shifting infrastructure/lures reduce the effectiveness of static detections, and noted overlap with a group it tracks as **Storm-0900**. TA584’s prevalent infection chain uses phishing emails sent from **hundreds of compromised, aged accounts** and delivered via services such as **SendGrid** and **Amazon SES**, with per-target URLs, **geofencing/IP filtering**, and redirect chains that can involve third-party **traffic distribution systems (TDS)** like *Keitaro*. Victims who pass filtering are led through a CAPTCHA page to a ClickFix page that instructs them to run a **PowerShell** command, which retrieves an obfuscated script and loads **XWorm** or **Tsundere Bot** in memory; Proofpoint assessed with high confidence that **Tsundere Bot infections could lead to ransomware**, given its observed capabilities for information gathering, exfiltration, lateral movement, and payload delivery. Kaspersky previously documented Tsundere Bot and linked it to a Russian-speaking operator associated with **123 Stealer**, and Proofpoint’s reporting ties its use directly to TA584’s access-brokering activity.
Jun 29, 2026