5 malware families

TA579

Also known asTA579

TA579 is a cybercriminal threat actor that Proofpoint has tracked since August 2021. Proofpoint attributed a March 2022 DocuSign-themed Bumblebee delivery campaign to TA579 with high confidence and reported that the actor had previously delivered BazaLoader and IcedID in past campaigns. In that Bumblebee activity, TA579 used email lures leading to zipped ISO files hosted on OneDrive, as well as HTML attachments masquerading as unpaid invoices. The ISO infection chain used LNK files to execute a DLL via rundll32 and launch Bumblebee. Proofpoint also attributed a March 2023 campaign involving AresLoader dropping the Lucky Volunteer information stealer to TA579 with high confidence. The reporting further notes that TA579 campaign IDs supported a previously suspected relationship distributing for another threat actor. Known alias in the provided content: TA579.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

3 of 15 tactics9 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566×2

Phishing

T1566.001×2

Spearphishing Attachment

T1566.002

Spearphishing Link

TA0002

Execution

2 techniques

T1059

Command and Scripting Interpreter

T1059.003

Windows Command Shell

T1204

User Execution

T1204.002×2

Malicious File

TA0005

Stealth

1 technique

T1218

System Binary Proxy Execution

T1218.011

Rundll32

ARSENAL

Associated malware families

5 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

IcedIDProofpoint has tracked a new malware loader called Bumblebee used by multiple crimeware threat actors previously observed delivering BazaLoader and IcedID.2May 31, 2026

AresloaderLucky Volunteer is a rarely observed information stealing payload previously identified in a March 2023 TA579 campaign in which AresLoader dropped Lucky Volunteer.1Jun 14, 2026

BazarBazaLoader is a first stage downloader first identified in 2020 that has been associated with follow-on ransomware campaigns including Conti.1May 31, 2026

BumblebeeStarting in March 2022, Proofpoint observed campaigns delivering a new downloader called Bumblebee. ... Bumblebee's objective is to download and execute additional payloads. Proofpoint researchers observed Bumblebee dropping Cobalt Strike, shellcode, Sliver and Meterpreter.1May 31, 2026

Lucky VolunteerIf the user copied and pasted the PowerShell script as instructed, it executed a second PowerShell script which used Bits transfer to download and run a malicious payload, suspected to be Lucky Volunteer.1Jun 14, 2026

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

proofpointNews

Nov 14, 2024

ClickFix Malware & Social Engineering Threat Grows | Proofpoint US

Referenced historically as a campaign cluster previously associated with AresLoader delivering Lucky Volunteer.

proofpoint threat insight blogNews

Apr 4, 2024

Latrodectus: This Spider Bytes Like Ice | Proofpoint UK

Referenced as an IcedID-affiliated activity cluster; campaign-ID theming and correlations suggest a distribution relationship with another actor, but no further TTP detail is provided here.

proofpoint threat insight blogNews

Apr 4, 2024

Latrodectus: This Spider Bytes Like Ice

Threat actor referenced in the IcedID campaign-ID attribution analysis; associated with IcedID campaigns and suspected of distributing for another threat actor.

proofpoint threat insight blogNews

Apr 28, 2022

This isn't Optimus Prime's Bumblebee but it's Still Transforming

Email-based crimeware activity distributing Bumblebee, and previously delivering BazaLoader and IcedID.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping6

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal5

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.