Loading threat actor…
TA579 is a financially motivated cybercriminal threat actor tracked since at least August 2021 and associated with malware delivery and initial-access operations. The actor has repeatedly been linked to email-borne intrusion campaigns and has historically distributed BazaLoader and IcedID, later transitioning to Bumblebee in campaigns observed in 2022. TA579’s activity is consistent with an initial access facilitator or broker role within the broader cybercrime ecosystem, enabling follow-on compromise by other actors. TA579 is known for socially engineered delivery chains using phishing lures and malicious attachments or links. Observed tradecraft includes delivery of ISO-based payloads, HTML attachments, and OneDrive-hosted archives, as well as use of redirector infrastructure to filter victims before payload delivery. In Bumblebee campaigns, TA579 used archive and disk-image infection chains containing shortcut files and malicious DLLs to launch the loader. The actor has also been associated with campaigns delivering DOUBLEBACK and with malware ecosystems involving IcedID and BazaLoader. The actor’s operational profile centers on malware delivery rather than public extortion or ransomware branding. Reported payloads and associations indicate strong overlap with crimeware activity that supports downstream post-compromise frameworks such as Cobalt Strike, Sliver, and Meterpreter through loaders like Bumblebee. This places TA579 within the cluster of cybercriminal actors that provide footholds later monetized through additional malware deployment and, potentially, ransomware operations by partner actors. No high-confidence country attribution is available from the supplied facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced historically as a campaign cluster previously associated with AresLoader delivering Lucky Volunteer.
Referenced as an IcedID-affiliated activity cluster; campaign-ID theming and correlations suggest a distribution relationship with another actor, but no further TTP detail is provided here.
Threat actor referenced in the IcedID campaign-ID attribution analysis; associated with IcedID campaigns and suspected of distributing for another threat actor.
Referenced only as a previously observed user of the DOUBLEBACK backdoor; not attributed to the OneNote campaign discussed here.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.