Loading threat actor…
TA2536 is a cybercrime threat actor associated with phishing campaigns that deliver commodity malware, including information stealers and remote access trojans. The actor has been observed using the DTPacker malware packer/downloader since at least 2020. In these operations, email serves as the primary initial access vector, typically through malicious attachments that lead to execution of DTPacker, which then decodes and launches follow-on payloads. Malware families delivered via DTPacker in campaigns linked to this ecosystem include Agent Tesla, Ave Maria (Warzone RAT), AsyncRAT, FormBook, Snake Keylogger, and Stealerium. TA2536’s tradecraft is consistent with financially motivated cybercrime focused on credential and information theft. The actor’s delivery chains rely on layered obfuscation and defense-evasion techniques, including custom XOR-based decoding, character-code substitution, string obfuscation, junk Unicode insertion, and staged payload retrieval. DTPacker’s dual role as both packer and downloader supports flexible post-delivery execution and complicates static analysis and detection. Campaigns associated with this tooling have affected organizations across multiple industries and involved high-volume phishing activity. TA2536 is one of multiple threat actors observed using DTPacker, indicating either shared access to a common criminal toolset or procurement through underground channels rather than exclusive actor-developed malware. Based on the available evidence, TA2536 is best characterized as a phishing-centric cybercriminal cluster specializing in malware delivery and credential-focused intrusion activity rather than a nation-state operator.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
2 malware families attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
E-crime phishing campaigns delivering the Stealerium information stealer (and previously associated with Snake Keylogger), using lures impersonating charities, banks, courts, and document services.
TA2536 is one of the threat actors observed using DTPacker to distribute remote access trojans (RATs) and information stealers such as Agent Tesla, Ave Maria, AsyncRAT, and FormBook. Their campaigns have used email as an initial infection vector and have targeted multiple industries.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.