2 malware families

TA575

Also known asTA575

TA575 is a financially motivated cybercrime threat actor tracked by Proofpoint since late 2020 and described as a Dridex affiliate. The group distributes malware via malicious URLs, Microsoft Office attachments, and password-protected files, and typically sends thousands of emails per campaign affecting hundreds of organizations. Reported lures include invoicing and payment themes as well as pop-culture or news themes. In October 2021, Proofpoint observed TA575 using 'Squid Game' themed phishing emails targeting organizations primarily in the United States, impersonating show-related contacts and enticing recipients with early access or casting opportunities. Those emails carried malicious Excel attachments with macros that downloaded Dridex from Discord-hosted URLs; Proofpoint associated the activity with Dridex affiliate ID 22203. The reporting states that TA575 uses Discord's CDN to host and distribute Dridex payloads. Dridex is described in the source material as a banking trojan also used for information gathering and as a loader that can enable follow-on infections, including ransomware. Known alias in the provided content: ta575.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

1 of 15 tactics3 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0001

Initial Access

1 technique

T1566

Phishing

T1566.001

Spearphishing Attachment

T1566.002

Spearphishing Link

ARSENAL

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

DridexThese criminal threat actors compromise victim organizations with first-stage malware like The Trick, Dridex, or Buer Loader and will then sell their access to ransomware operators to deploy data theft and encryption operations.2Jun 14, 2026

Cobalt Strike...TA575 criminal group is made up of prolific, financially-motivated opportunists who specialize in Dridex malware and operate swaths of Cobalt Strike servers.1Mar 18, 2026

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

proofpoint threat insight blogNews

Oct 28, 2021

TA575 Uses ‘Squid Game’ Lures to Distribute Dridex malware

TA575 is a Dridex affiliate known for distributing malware via malicious emails, often using popular cultural references as lures. In this campaign, TA575 used Squid Game-themed phishing emails with malicious Excel attachments to deliver Dridex banking trojan, primarily targeting organizations in the United States.

proofpointNews

Jun 14, 2021

How Initial Access Brokers Lead to Ransomware | Proofpoint US

Dridex affiliate distributing malware through multiple email-delivered formats including malicious URLs, Office attachments, and password-protected files.

zdnet zero dayNews

Jan 17, 2026

TA575 criminal group using 'Squid Game' lures for Dridex malware

Financially motivated cybercrime group tracked by Proofpoint since late 2020; runs large-scale email campaigns using pop-culture lures (e.g., "Squid Game") to deliver Dridex via malicious Office attachments, leveraging Discord CDN URLs for payload hosting/delivery; associated with operating Cobalt Strike infrastructure and using Dridex as a banking trojan and loader for follow-on infections (including ransomware).

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping3

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.