TA551 (G0127) | Threat Actor Index

Techniques

Toolsets

CVEs Referenced

KEV Entries

About TA551

TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.

View MITRE record ↗

Techniques by Tactic (14)

Reconnaissance

T1589.002 Email Addresses

Initial Access

T1566.001 Spearphishing Attachment

Execution

T1059.003 Windows Command ShellT1204.002 Malicious File

Stealth

T1027.003 SteganographyT1027.010 Command ObfuscationT1036 MasqueradingT1218.005 MshtaT1218.010 Regsvr32T1218.011 Rundll32

Command & Control

T1071.001 Web ProtocolsT1105 Ingress Tool TransferT1132.001 Standard EncodingT1568.002 Domain Generation Algorithms

Toolsets (5)

🐛

IcedID S0483

Malware · Windows

🐛

QakBot S0650

Malware · Windows

🐛

Ursnif S0386

Malware · Windows

🐛

Valak S0476

Malware · Windows

🔧

Sliver S0633

Tool · Windows, Linux, macOS

References & Reports (3)

Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.
Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021.
Secureworks. (n.d.). GOLD CABIN Threat Profile. Retrieved March 17, 2021.

↑