TA547

TA547 is a financially motivated cybercriminal threat actor, also referred to as Scully Spider in the provided content. The actor is described as prolific and is considered an initial access broker (IAB). TA547 has primarily distributed banking trojans and other malware via email campaigns, and has targeted multiple geographic regions, including Germany, Spain, Switzerland, Austria, the United States, and Australia. The actor often uses geofencing and has blacklisted VPN exit IP addresses, which can limit payload retrieval by region. The content states that TA547 has distributed banking malware including ZLoader, The Trick, Ursnif, Gootkit, Corebot, Panda Banker, Atmos, Mazar Bot, Red Alert Android malware, and DanaBot. Proofpoint observed TA547 delivering DanaBot in 2018, including campaigns targeting Australia, and notes that TA547 regularly distributed DanaBot using affiliate IDs 5 and 6. Separate reporting in the content says the gang tracked as TA547 and Scully Spider offered access to DanaBot for approximately $3,000 to $4,000 per month. The content also notes that from 2018 through 2020 DanaBot was delivered by TA547, TA571, and TA564. More recently, TA547 has used sophisticated banking malware, loaders, and information stealers. Since 2023, the actor has typically delivered NetSupport RAT, and has also delivered StealC and Lumma Stealer. In early 2024, TA547 was observed shifting from zipped JavaScript attachments to compressed LNK attachments. Proofpoint identified TA547 targeting German organizations with invoice-themed emails impersonating Metro and delivering Rhadamanthys. In that campaign, password-protected ZIP archives contained LNK files that launched PowerShell to fetch a remote script, decode a Base64-encoded Rhadamanthys payload, and execute it in memory as a .NET assembly. The content states this was the first observed TA547 use of Rhadamanthys, and elsewhere notes TA547 leveraged Rhadamanthys throughout 2024. The content further notes that researchers suspected TA547 used a PowerShell loader with comments consistent with AI-generated code in the Rhadamanthys delivery chain, although Proofpoint stated this did not alter the payload itself and did not change defensive detection approaches. The broader ecosystem reporting in the content also links RM3_boss's ISFB/Gozi-related ecosystem to TA547, alongside TA543, QQAAZZ, Evil Corp, and Dridex operations.