Loading threat actor…
TA578 is a financially motivated cybercrime threat actor tracked since 2020 and best known for large-scale email- and web-form-based malware delivery operations. The actor has repeatedly used contact-form abuse, thread hijacking, spam campaigns, and malicious archive or disk-image attachments to gain initial access and deliver follow-on malware. TA578 is commonly associated with delivery of IcedID, Bumblebee, Ursnif, KPOT Stealer, Buer Loader, BazaLoader, DanaBot, and later Latrodectus, with Cobalt Strike frequently observed as a post-compromise payload. A defining TA578 tradecraft pattern is the use of website contact forms with complaint-themed or stolen-image lures to initiate conversations with targets, followed by delivery of malicious links or attachments. The actor has also used thread-hijacked emails to increase credibility and has distributed ISO-based infection chains containing Windows shortcut files that invoke rundll32 to launch malicious DLL payloads. JavaScript has also appeared in TA578 execution chains, and the actor has used cloud-hosted content to stage malicious scripts and payload delivery. Observed TA578 activity shows a role centered on initial access and malware distribution rather than exclusive operation of a single malware family. Campaigns attributed to TA578 have delivered Bumblebee as a loader for additional tooling, IcedID with BackConnect functionality, DanaBot, and Latrodectus. In some intrusions, follow-on activity included SOCKS proxying, internal network scanning, virtual network computing access, reverse-shell-style post-exploitation, and deployment of Cobalt Strike. Reporting also indicates that Latrodectus distribution became strongly associated with TA578 during 2024. TA578 is widely characterized as an eCrime actor and likely initial access broker or malware delivery specialist operating in support of broader financially motivated intrusion ecosystems. High-confidence public reporting links the actor to phishing and malware delivery campaigns globally, but does not firmly establish a national affiliation.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
28 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
105 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with the MMC/GrimResource detection analytic.
Listed in annotations as a threat actor associated with the detection context; no specific activity beyond inclusion in the analytic metadata is described.
Conducts email campaigns delivering malware loaders and stealers; referenced here in relation to Bumblebee delivery via contact forms and hijacked email threads.
Listed as a threat actor associated with malicious link execution and spearphishing attachment activity relevant to ISO/LNK delivery detection.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.