Loading story…
Proofpoint reported that threat actor TA505 launched phishing campaigns using a newly identified downloader, AndroMut, to deliver the FlawedAmmyy remote access trojan. The activity targeted recipients in South Korea and financial institutions in Singapore, the UAE, and the United States, with lures delivered through HTM and HTML attachments that either linked to malicious Office documents or directly dropped macro-enabled Word and Excel files.
AndroMut was described as a C++ downloader with anti-analysis capabilities, encrypted strings, runtime API hashing, and persistence mechanisms. Proofpoint said the malware communicated with command-and-control infrastructure over HTTP POST, sending AES-256-encrypted JSON data, and assessed it as a new malware family with limited similarities to Andromeda and QtLoader while observing it used in TA505 operations to install FlawedAmmyy.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Proofpoint observed a second TA505 campaign in June 2019 targeting financial institutions in Singapore, the UAE, and the United States. The campaign used HTM or HTML attachments and macro-enabled Office files to deliver AndroMut or FlawedAmmyy loaders.
Proofpoint observed one of two distinct TA505 campaigns using AndroMut to download FlawedAmmyy targeting recipients in South Korea. The phishing activity used HTM or HTML attachments that linked to malicious Office files.
Proofpoint observed TA505 introducing a new downloader malware named AndroMut in June 2019. In these operations, AndroMut was used to retrieve the FlawedAmmyy remote access trojan.
Proofpoint researchers observed TA505 distributing a new backdoor named ServHelper beginning in November 2018. The malware had two variants, including one focused on remote desktop functions and another that primarily acted as a downloader.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 20 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that **TA505** ran large-scale malspam campaigns delivering a new downloader called **Get2**, which profiled infected hosts and fetched follow-on malware including **FlawedGrace**, **FlawedAmmyy**, **Snatch**, and a newly identified remote access trojan, **SDBbot**. The activity used malicious Excel attachments and later URL-shortener links, and targeted financial institutions and other organizations across multiple countries including the United States, Canada, Germany, Greece, Singapore, Sweden, Lithuania, Georgia, and the United Arab Emirates. SDBbot was described as a C++ RAT built from installer, loader, and bot components, with persistence mechanisms including **Run keys**, **Image File Execution Options**, and **application shimming via SDB files**; Proofpoint assessed that Get2's reboot behavior likely helped activate that persistence. A public GitHub project later published a Python 2.7 **SDBbot unpacker** capable of extracting statically linked x86 and x64 modules such as `SdbInstallerDll`, `RegCodeLoader`, `RegBlob`, and `BotDLL`, giving defenders and researchers a way to dissect packed SDBbot samples and better understand the malware's internal structure.
Aug 15, 2026
Proofpoint reported that threat actor **TA555** used a previously unknown downloader called **AdvisorsBot** in malicious email campaigns targeting victims with hotel, restaurant, and telecommunications-themed lures. First observed in May 2018, the malware acted as an initial payload that contacted command-and-control infrastructure over **HTTPS**, retrieved a fingerprinting module, and profiled infected systems to identify higher-value targets for follow-on compromise. Researchers said AdvisorsBot incorporated multiple anti-analysis features, including junk code, stack strings, API hashing, CRC32-based process and volume checks, virtual machine detection, and later machine SID blacklisting. Its modular design allowed operators to load DLLs or shellcode, and observed capabilities included screenshot capture, Outlook account collection, and broad host reconnaissance; by August, TA555 had also shifted to fileless shellcode execution and introduced a rewritten PowerShell/.NET variant, **PoshAdvisor**, while retaining the same command-and-control protocol and victim-fingerprinting behavior.
Aug 14, 2026
Threat researchers and incident responders linked **TA505** to a years-long progression from massive malspam operations delivering **Dridex**, **Locky**, **Jaff**, **GlobeImposter**, and other payloads to more targeted intrusions aimed at full-network compromise and ransomware deployment. Early campaigns relied heavily on the **Necurs** botnet and phishing lures with malicious PDFs, macro-enabled Word documents, ZIP archives, `.url` shortcuts, and `.iqy` files, while later operations introduced loaders and remote-access malware including **FlawedAmmyy**, **Marap**, **FlowerPippi**, and **Gelup**. Researchers reported that these tools supported host fingerprinting, encrypted command-and-control, persistence, privilege escalation, and delivery of follow-on payloads, showing a shift from simple malware distribution to modular access operations. The group’s later activity culminated in enterprise-wide attacks associated with **Clop** ransomware, including the compromise of **Maastricht University**, where attackers reportedly entered through phishing, escalated privileges on an unpatched system, mapped the network, harvested credentials, and encrypted **267 Windows servers**, leading the university to pay a **30 bitcoin** ransom. Separate reporting on 2020 **Dridex** campaigns showed continued use of macro-enabled documents, PowerShell downloaders, `rundll32.exe`, HTTPS command-and-control, and multiple persistence mechanisms, underscoring that TA505 maintained high-volume delivery tactics even as it adopted tools such as **Mimikatz**, **Cobalt Strike**, **WMIC**, **RDP**, **PowerSploit**, **PingCastle**, and **AdFind** to move laterally, disable defenses, and prepare domain-wide ransomware deployment and, in some cases, extortion through stolen data.
Aug 15, 2026