TA544

TA544 is a financially motivated ecrime threat actor and likely malware affiliate / initial access facilitator first tracked by Proofpoint in February 2017. It is also known as Narwhal Spider and Storm-0302. The actor has conducted high-volume malicious email campaigns, at times sending hundreds of thousands of messages per day and tens of millions of messages across multiple countries, with a primary geographic focus on Italy and Japan and historical activity in Germany, Poland, and Spain. TA544 has distributed multiple banking malware and loader payloads over time, including Panda Banker, Chthonic, Smoke Loader, Nymaim, ZLoader, URLZone, Ursnif, Dridex, IcedID, BrushaLoader, and DanaBot. Proofpoint described TA544 as responsible for much of the Ursnif volume in Japan via URLZone infections, and noted TA544 has also been associated with initial access activity that can lead to ransomware infections. By 2019, TA544 was primarily focused on Ursnif and URLZone. Ursnif affiliate ID 1000 is closely associated with TA544 in Japan, while Ursnif 4777, 4778, 4779, and 4780 were used in Italy. TA544 most commonly delivers malware through malicious email using Microsoft Office attachments with macros, especially Excel documents, as well as password-protected ZIP files and compressed JScript, JavaScript, or Visual Basic scripts. Campaigns are localized by language, branding, filenames, and social engineering themes, often using invoice- or payment-themed lures. The actor has used geofencing and locale checks to verify victims are in the intended country, including checks associated with Japanese systems. TA544 is also known for using steganography to conceal malicious code in images embedded in Office-document infection chains. In Japan, TA544 commonly used Excel macro documents to install URLZone, which then downloaded Ursnif. In Italy, TA544 delivered Panda Banker, Chthonic, Smoke Loader, and multiple Ursnif variants. The actor also used BrushaLoader in at least one T-Mobile-themed campaign in May 2019, used IcedID in limited campaigns throughout 2022 targeting organizations in Italy and Japan, and delivered DanaBot in a campaign observed in February 2024. Proofpoint later observed TA544 decrease activity or disappear from email campaign data since mid-2024. TA544 has been described as one of the most prolific geographically focused threat actors in email-based cybercrime, particularly targeting manufacturing, technology, IT, and marketing organizations in Japan and Italy.