TA2541

TA2541 is a persistent cybercriminal threat actor tracked by Proofpoint that has conducted malware campaigns since at least January 2017. It targets organizations in the aviation, aerospace, transportation, manufacturing, and defense sectors, using aviation-, transportation-, and travel-themed social engineering lures and often impersonating aviation firms. Campaigns have affected hundreds of organizations globally, with recurring targets in North America, Europe, and the Middle East. Proofpoint assesses TA2541 as financially motivated rather than espionage-focused, based on its use of commodity malware, broad targeting, high-volume phishing, and recurring infrastructure patterns. TA2541 primarily gains initial access through phishing emails, usually in English, with malicious attachments or links. It historically used macro-enabled Microsoft Word documents and has also used RAR archives containing executables. Later campaigns shifted toward links to cloud-hosted payloads on services such as Google Drive, and in some cases DiscordApp URLs. TA2541 has uploaded or staged malware on Google Drive, Pastetext, Sharetext, GitHub, and paste.ee. The actor distributes commodity remote access trojans and has used more than a dozen malware payloads since 2017. AsyncRAT is identified as its current preferred payload. Other malware associated with TA2541 includes NetWire, WSH RAT, Parallax, AgentTesla, Imminent Monitor, STRRAT, Revenge RAT, vjw0rm, and occasionally VenomRAT. TA2541 has also used multiple malware strains available for purchase on criminal forums or in open-source repositories. Observed tradecraft includes obfuscated VBS files that launch PowerShell to retrieve malware, PowerShell-based downloading and injection into Windows processes, WMI queries to identify security products, collection of system information before downloading RAT payloads, attempts to disable built-in Windows security protections including AMSI, use of TLS-encrypted C2 communications including with AsyncRAT, compressed and char-encoded scripts, and masquerading via filenames that mimic legitimate Windows files or system functionality. TA2541 has established persistence through VBS files in the Startup folder, scheduled tasks, and Windows Registry Run keys. Proofpoint also noted recurring infrastructure characteristics including use of VPS-based email infrastructure, Dynamic DNS for C2, and repeated keywords such as "kimjoy," "h0pe," and "grace."