Loading story…
MITRE ATT&CK tracks TA578 (G1038) as a threat actor that approaches organizations through website contact forms and email, often using fake copyright-infringement complaints to persuade recipients to follow attacker-controlled download links. Its campaigns have delivered the Latrodectus, IcedID, and Bumblebee malware families.
TA578 has hosted malicious scripts on Google Firebase and incorporated JavaScript into its execution chains. The malware it distributes can enable follow-on discovery, persistence, defense evasion, command execution, encrypted command-and-control communications, and data exfiltration, making inbound contact-form submissions and copyright-themed messages a material phishing risk.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
MITRE ATT&CK created group G1038 for TA578, documenting its use of website contact forms and email to deliver malware including Latrodectus, IcedID, and Bumblebee.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked a long-running cybercrime actor tracked as **TA2541** to years of phishing campaigns against aviation, aerospace, transportation, manufacturing, and defense organizations. Cisco Talos and Proofpoint assessed the actor as likely operating from **Nigeria**, using aviation- and travel-themed lures such as fake itineraries, charter details, and regulator impersonation to trick targets into opening malicious documents or cloud-hosted payload links. The campaigns have delivered commodity remote access trojans including **AsyncRAT**, **njRAT**, **NetWire**, **WSH RAT**, **Parallax**, **AgentTesla**, **STRRAT**, **Imminent Monitor**, and **vjw0rm**, with recurring infrastructure and identifiers such as dynamic DNS domains and keywords including **"kimjoy," "h0pe,"** and **"grace."** The intrusion chains evolved over time but remained operationally consistent: earlier waves used macro-enabled Word files, while later activity shifted to **Google Drive**, **OneDrive**, and **Discord** links hosting VBS payloads. Talos documented more complex stages involving malicious Publisher macros, `mshta`, PowerShell, AMSI bypass code, and GitHub-hosted payloads, while Fortinet described a campaign in which a Google Drive-delivered VBS script dropped XML with inline C# code, used **MSBuild.exe** for execution, and hollowed **RegSvcs.exe** to inject **AsyncRAT**, likely with ties to **Snip3 Crypter** infrastructure. Despite limited technical sophistication, the actor has maintained multi-year access operations that enable credential theft, fraud, and potential access brokerage across aviation-related targets.
Aug 15, 2026
TA558, a financially motivated threat actor active since 2018, has persistently targeted hospitality, hotel, and travel organizations—primarily in Latin America—using Portuguese- and Spanish-language reservation and booking lures. Researchers linked the actor to repeated campaign markers such as the string **"CDT"**, fake travel and hotel branding, and attacker-controlled or compromised hospitality infrastructure. Proofpoint reported that TA558 expanded activity and shifted delivery techniques from macro-enabled Office files to URLs and container attachments such as `RAR` and `ISO`, while continuing to distribute a broad set of remote access trojans including **Loda RAT**, **Revenge RAT**, **AsyncRAT**, **njRAT**, **Ozone RAT**, and **Vjw0rm**. Multiple investigations show the campaigns using multi-stage infection chains to gain remote access and steal data. Cisco Talos documented **Loda RAT** delivery through phishing documents exploiting `CVE-2017-11882`, with capabilities including keylogging, screenshots, audio capture, FileZilla credential theft, and WMI-based antivirus enumeration. Uptycs tied a Brazilian hotel-themed lure, **"Rooming List Reservas para 3 Familias.docx,"** to **Revenge RAT** delivered via remote template injection and staged PowerShell and VBScript, while Elastic observed a related booking-themed chain using a fake **"Card & Booking Details.docx"** document to deploy **XWORM** and **Agent Tesla**, disable defenses, create persistence, and exfiltrate data through a Discord webhook. The activity indicates sustained credential theft, reconnaissance, follow-on malware delivery, and potential financial fraud against both travel-sector organizations and their customers.
Aug 15, 2026
Cybersecurity researchers have identified a new threat actor, TA585, which has been actively delivering the MonsterV2 malware through a series of sophisticated phishing campaigns. TA585 distinguishes itself by managing its entire attack chain, from infrastructure setup and email delivery to malware installation, without relying on third-party distribution services or initial access brokers. The group has been observed using U.S. Internal Revenue Service (IRS) themed phishing lures to entice victims into clicking malicious links. These links often direct users to PDFs that further redirect to web pages employing the ClickFix social engineering tactic, which prompts users to execute malicious commands via the Windows Run dialog or PowerShell terminal. The initial PowerShell command triggers a secondary script that ultimately deploys MonsterV2 on the victim's system. In later campaigns, TA585 shifted tactics to use malicious JavaScript injections on legitimate websites, presenting fake CAPTCHA overlays to initiate the infection process. This approach also leverages ClickFix to deliver the malware payload. MonsterV2, also known as Aurotun Stealer, is a remote access trojan (RAT), stealer, and loader, first advertised on criminal forums in February 2025. The malware is notable for its high price and limited user base, with TA585 being one of the few actors deploying it. MonsterV2 is designed to avoid infecting systems located in Commonwealth of Independent States (CIS) countries, demonstrating a level of geographic targeting. Prior to adopting MonsterV2, TA585 campaigns distributed other malware such as Lumma Stealer, indicating a shift in their preferred payloads. The group’s use of web injection and filtering checks adds complexity to their attack chains, making detection and mitigation more challenging. Researchers have highlighted TA585’s innovation in the constantly evolving cybercrime landscape, noting their deviation from the typical "gig economy" model of cybercrime by maintaining end-to-end control over their operations. The campaigns have evolved over time, with new delivery techniques and social engineering tactics being introduced to increase infection rates. The technical sophistication of TA585’s infrastructure and delivery methods underscores the growing threat posed by self-sufficient cybercriminal groups. Security teams are advised to monitor for indicators of compromise related to MonsterV2 and to educate users about phishing tactics involving IRS-themed lures and fake CAPTCHA overlays. The emergence of TA585 and its operational model signals a trend toward more autonomous and innovative threat actors in the cybercrime ecosystem. Ongoing research and intelligence sharing are critical to tracking the evolution of TA585 and mitigating the risks associated with MonsterV2 and similar malware families.
Jun 29, 2026