TA547

TA547, also known as Scully Spider, is a prolific financially motivated cybercrime threat actor and initial access broker associated with large-scale email campaigns that distribute banking trojans, information stealers, loaders, remote access tools, and occasionally ransomware. The actor has been active since at least 2017 and is known for abusing email service providers, using high-volume malspam, geofencing payload delivery, and rotating malware families according to monetization opportunities and campaign objectives. TA547 has distributed malware including DanaBot, Ursnif, ZLoader, The Trick, Gootkit, Corebot, Panda Banker, Atmos, Mazar Bot, NetSupport RAT, StealC, Lumma Stealer, and Rhadamanthys. The actor has also been linked to delivery of Adhubllka ransomware in at least one campaign, indicating experimentation with direct ransomware deployment in addition to its more common role as a malware distributor and access broker. TA547 has been described as purchasing or leasing malware from other operators, including banking trojans offered as malware-as-a-service. The group primarily relies on email-based initial access using invoice, order confirmation, job applicant, logistics, and other business-themed lures. Observed delivery chains have included malicious Office documents with macros, zipped JavaScript, password-protected archives, Windows shortcut files, and PowerShell-based downloaders. TA547 has demonstrated frequent changes in attachment format and infection chain design, including shifts from macro-enabled documents to compressed shortcut-based delivery and in-memory execution. Campaigns have used geofencing and VPN blocking to restrict payload access by region and reduce researcher visibility. TA547 has targeted organizations across multiple regions, with repeated activity against Australia and Germany and additional targeting observed in Spain, Switzerland, Austria, the United States, Italy, and the United Kingdom. Documented victim sectors include construction, transportation, entertainment and media, aerospace, manufacturing, logistics, hospitality, and retail-adjacent business environments. The actor has conducted both broad-volume spam operations and more selective campaigns against dozens of organizations. Operationally, TA547 is associated with credential theft, information theft, initial compromise, and malware staging for downstream criminal activity. Its use of banking trojans and stealers supports credential harvesting, financial fraud, and resale or reuse of access. Reporting also places TA547 among prominent distributors of DanaBot, including affiliate activity tied to that malware ecosystem. Some reporting and law-enforcement material have linked the DanaBot ecosystem and actors tracked as TA547/Scully Spider to Russia-based cybercrime, but attribution at the level of the broader TA547 cluster should be treated carefully unless specifically tied to the DanaBot-associated subgroup. TA547 has also shown willingness to adopt newer tradecraft, including PowerShell loaders assessed as potentially AI-assisted in code generation, though this did not materially change the underlying malware behavior. Overall, TA547 is best characterized as an adaptable eCrime operator focused on email-driven initial access, credential and information theft, and enabling follow-on financially motivated intrusion activity.