Loading threat actor…
TA544, also known as Narwhal Spider and Storm-0302, is a financially motivated cybercriminal threat actor and malware distributor active since at least 2017. The actor is best known for high-volume malicious email campaigns delivering banking malware and other first-stage payloads, with a long-running emphasis on Italy and Japan. TA544 has historically operated as an affiliate-style distributor or initial access facilitator rather than as the exclusive developer of the malware it spreads. TA544 was first associated with campaigns targeting Italian users with Panda Banker and later expanded to additional malware families including Chthonic, Smoke Loader, Nymaim, ZLoader, URLZone, BrushaLoader, IcedID, DanaBot, Dridex, WikiLoader, and especially Ursnif. By 2019, Ursnif had become its most characteristic payload, often delivered directly or through intermediary loaders such as URLZone or WikiLoader. In Japan, TA544 commonly used Excel macro documents to install URLZone or Bebloh and then deploy Ursnif. In Italy, it frequently delivered Ursnif variants in localized campaigns using Italian-language lures and branding. The actor is notable for geographically focused operations. Italy and Japan are the most consistently documented target countries, with historical activity also observed against Germany, Poland, Spain, the United States, Australia, and Canada. Targeting has included organizations in financial services, information technology, industrial and manufacturing sectors, and in some cases energy-themed lures aimed at Italian organizations. In Japan, campaigns have targeted banks, credit card companies, and cryptocurrency-related entities through Ursnif web-injection and credential-theft functionality. TA544 primarily relies on malspam for initial access. Common delivery mechanisms include malicious Microsoft Office documents with VBA or Excel 4.0 macros, OneNote attachments, password-protected archives, compressed script files, HTML or PDF lures leading to downloader content, and malicious URLs. The actor regularly localizes social-engineering themes to the victim region, including invoice, payment, courier, logistics, accounting, telecommunications, and government-service pretexts. TA544 has also used compromised or themed infrastructure and geofencing to ensure payload execution primarily on intended victims. Tradecraft associated with TA544 includes reconnaissance of victim geography, defense evasion through obfuscation and steganography, and staged malware delivery. Campaigns have used heavily obfuscated macros, concealed code in images, locale checks for Japanese environments, and server-side location filtering. Follow-on malware associated with TA544 supports credential theft, web injects, proxying, remote access, and additional payload delivery. Reporting has also linked TA544 initial-access activity to later ransomware infections, although TA544 itself is principally characterized as an access or malware delivery actor rather than a ransomware operator. TA544 has shown flexibility in working with multiple malware ecosystems over time. It has been observed distributing Standard IcedID in limited campaigns, DanaBot in 2024, and WikiLoader in campaigns primarily against Italian organizations beginning in late 2022. Activity reportedly declined or disappeared from observed email campaign data from mid-2024, consistent with broader disruption to initial access broker and loader ecosystems.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
31 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
16 malware families attributed to this actor across reporting.
11 additional families tracked in Mallory.
72 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named threat actor referenced in global threat reporting.
Ecrime actor observed delivering DanaBot in a 2024 campaign; its initial access activity has previously been associated with ransomware infections.
Tracked initial access broker whose email campaign activity decreased or disappeared since mid-2024.
Referenced as an IcedID-affiliated activity cluster distinguished by themed IcedID bot campaign IDs (Italian references). No additional operational details provided in this content.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.