Loading threat actor…
TA575 is a financially motivated cybercrime threat actor and Dridex affiliate active since at least late 2020. The group is known for large-scale email campaigns that distribute malware through malicious URLs, Microsoft Office attachments, and password-protected files. Its operations commonly rely on social-engineering lures tied to invoices, payments, tax themes, government relief programs, and high-profile pop-culture events to drive victims into opening weaponized documents or submitting sensitive information. TA575 has repeatedly delivered Dridex, a banking trojan also used as a loader for follow-on compromise. Observed campaigns used Excel documents with macros to retrieve malware after user interaction. The actor has impersonated tax authorities and related entities in tax-themed phishing operations, including lures associated with U.S. government relief themes, and has also used entertainment-themed campaigns such as Squid Game impersonation to target organizations at scale. Reporting indicates these campaigns often reached thousands of recipients and affected hundreds to thousands of organizations across multiple sectors. The actor’s tradecraft includes phishing-based initial access, credential-focused social engineering, malware delivery via macro-enabled Office files, and use of legitimate cloud or content-delivery services to host payloads in order to blend malicious traffic with normal activity and reduce detection. TA575 has been associated with broad targeting across dozens of verticals, including educational institutions and organizations in manufacturing, healthcare, and energy. Because Dridex can support banking theft, information gathering, and downstream intrusion activity, TA575 is best understood as an initial-access and malware-distribution actor within the broader cybercrime ecosystem rather than a ransomware operator itself.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
TA575 is a Dridex affiliate known for distributing malware via malicious emails, often using popular cultural references as lures. In this campaign, TA575 used Squid Game-themed phishing emails with malicious Excel attachments to deliver Dridex banking trojan, primarily targeting organizations in the United States.
Dridex affiliate distributing malware through multiple email-delivered formats including malicious URLs, Office attachments, and password-protected files.
Conducting tax-themed malicious email campaigns using IRS/American Rescue Plan lures to deliver banking malware for financial theft.
Financially motivated cybercrime group tracked by Proofpoint since late 2020; runs large-scale email campaigns using pop-culture lures (e.g., "Squid Game") to deliver Dridex via malicious Office attachments, leveraging Discord CDN URLs for payload hosting/delivery; associated with operating Cobalt Strike infrastructure and using Dridex as a banking trojan and loader for follow-on infections (including ransomware).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.