Loading story…
The TA551 (also tracked as Shathak) threat group used large-scale malspam campaigns to distribute malware including Ursnif, Valak, IcedID, and Qakbot through hijacked email threads and password-protected ZIP attachments. The lures typically contained malicious Microsoft Word documents that urged users to enable macros, after which the infection chain launched follow-on components such as HTA files, obfuscated JavaScript, XSL files, and DLL payloads executed with Windows utilities including regsvr32.exe and rundll32.exe. Researchers also observed language-specific campaigns, including German-language spam, and noted that Valak frequently acted as both an information stealer and loader for additional malware such as NetSupport Manager RAT and IcedID.
Analysis of TA551 infrastructure found repeatable patterns across hundreds of domains, including registrar and DNS-provider preferences, TLS certificate behavior, and numeric naming conventions that helped identify likely new campaign domains before they were widely used. Defenders were advised to watch for suspicious process chains such as Word spawning mshta.exe, followed by regsvr32.exe, as well as file-type masquerading, scheduled-task persistence, registry modifications, Alternate Data Streams, and Temp-directory artifacts associated with Ursnif and Valak infections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
HP Wolf Security found that TA551's preferred DNS provider shifted over time, with DNSPod disappearing after mid-November and GeoScaling and Cloudflare appearing instead.
HP Wolf Security analyzed about 500 known TA551 domains spanning July 2020 to December 2020 to identify recurring registration, DNS, and TLS patterns tied to the group's payload-hosting infrastructure.
Unit 42 said Valak became increasingly prevalent from April through June 2020, largely through distribution by the Shathak/TA551 malspam network.
Unit 42 reported that passwords for ZIP attachments in Shathak/TA551 campaigns had been unique per recipient since May 2020, indicating a change in delivery tradecraft.
Unit 42 reported that since April 2020, Valak became the most common malware distributed by Shathak/TA551, replacing Ursnif as the group's primary payload.
On 2020-01-21, a German-language malspam wave used hijacked email chains and password-protected ZIP attachments to distribute Ursnif. Victims were prompted to enable macros in a Word document, which dropped an XSL file, retrieved an Ursnif DLL, and executed it via rundll32.exe.
Unit 42 reported that Valak was documented as follow-up malware during Ursnif infections in December 2019, showing its early role alongside TA551-delivered malware chains.
Unit 42 said Valak was first observed in late 2019 as an information stealer and malware loader. It was also first detected by Proofpoint's ET Pro ruleset in October 2019.
HP Wolf Security reported that TA551 had been observed distributing malware including Ursnif since the beginning of 2019. Unit 42 also noted that before April 2020, Shathak/TA551 primarily distributed Ursnif.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
threatresearch.ext.hp.com
Open sourceunit42.paloaltonetworks.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Valak** is a modular, enterprise-focused malware family spread through **reply-chain email hijacking** and malicious attachments or links, often using **password-protected ZIP files** to evade inspection. Campaigns targeted organizations across sectors including manufacturing, transportation, finance, insurance, health care, and energy, with infection chains commonly relying on Microsoft Word macros or JavaScript droppers that launched payloads through Windows LOLBins such as `regsvr32.exe` and `wscript` to load DLLs in memory and reduce detection. Multiple reports tied Valak to the broader **Gozi/Ursnif** ecosystem through overlapping infrastructure, delivery patterns, and follow-on activity. Analysts said Valak used compromised websites and PHP proxy scripts to fetch staged payloads and track spam delivery, while specialized plugins such as **EXCHGRABBER** and **CLIENTGRABBER** stole Exchange, Office, and email credentials from Credential Manager, autodiscover data, and the Windows registry. Related Gozi/Ursnif campaigns used hijacked email threads, Google Drive links, and password-protected archives before deploying additional tools including **Cobalt Strike**, **TVRat/TeamViewer**, and VNC-based modules, reinforcing the connection between credential theft, thread hijacking, and multi-stage enterprise intrusion activity.
Aug 15, 2026
Threat researchers and incident responders linked **TA505** to a years-long progression from massive malspam operations delivering **Dridex**, **Locky**, **Jaff**, **GlobeImposter**, and other payloads to more targeted intrusions aimed at full-network compromise and ransomware deployment. Early campaigns relied heavily on the **Necurs** botnet and phishing lures with malicious PDFs, macro-enabled Word documents, ZIP archives, `.url` shortcuts, and `.iqy` files, while later operations introduced loaders and remote-access malware including **FlawedAmmyy**, **Marap**, **FlowerPippi**, and **Gelup**. Researchers reported that these tools supported host fingerprinting, encrypted command-and-control, persistence, privilege escalation, and delivery of follow-on payloads, showing a shift from simple malware distribution to modular access operations. The group’s later activity culminated in enterprise-wide attacks associated with **Clop** ransomware, including the compromise of **Maastricht University**, where attackers reportedly entered through phishing, escalated privileges on an unpatched system, mapped the network, harvested credentials, and encrypted **267 Windows servers**, leading the university to pay a **30 bitcoin** ransom. Separate reporting on 2020 **Dridex** campaigns showed continued use of macro-enabled documents, PowerShell downloaders, `rundll32.exe`, HTTPS command-and-control, and multiple persistence mechanisms, underscoring that TA505 maintained high-volume delivery tactics even as it adopted tools such as **Mimikatz**, **Cobalt Strike**, **WMIC**, **RDP**, **PowerSploit**, **PingCastle**, and **AdFind** to move laterally, disable defenses, and prepare domain-wide ransomware deployment and, in some cases, extortion through stolen data.
Aug 15, 2026
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026