TA571

TA571 is a financially motivated cybercriminal threat actor and high-volume spam distributor that operates spam botnets and has been associated with the 404TDS traffic distribution system. Proofpoint has tracked TA571 since 2019 distributing and installing malware for cybercriminal customers, and prior reporting indicates the actor operates as an FIA (financially motivated initial access) group. TA571 has been described as an initial access broker/group whose infections can lead to ransomware. Observed malware distributed by TA571 includes Ursnif, ZLoader, DanaBot, IcedID including the Forked variant, Rhadamanthys, DarkGate, NetSupport RAT, Matanbuchus, and malware associated with TA866/Asylum Ambuscade. Reporting also notes delivery of AsyncRAT and other malware via 404TDS. TA571 commonly uses high-volume malspam, thread hijacking, HTML attachments, malicious URLs, password-protected ZIP archives, legitimate file hosting services, compromised or spoofed infrastructure, and gated delivery chains with IP and geo-fencing. The actor has also used OneDrive links in PDF attachments and VBS, JavaScript, MSI, HTA, and PowerShell-based infection chains. TA571 was an early observed user of the ClickFix social-engineering technique. Proofpoint first observed TA571 using ClickFix on 1 March 2024 in a campaign of more than 100,000 messages targeting thousands of organizations globally. In these campaigns, HTML attachments impersonated Microsoft Word or OneDrive content and tricked users into copying and executing base64-encoded PowerShell commands, leading to payloads such as DarkGate, Matanbuchus, and NetSupport RAT. TA571 also used root-certificate-themed lures similar to ClearFake. Proofpoint coined the term ClickFix based on activity by TA571 and ClearFake. TA571 has also been linked to major malware delivery campaigns. In October 2023, Proofpoint observed TA571 delivering Forked IcedID in thread-hijacking campaigns using 404TDS URLs, password-protected ZIP files, and regsvr32 execution. In January 2024, Proofpoint attributed spam distribution in a TA866-related campaign to TA571, where invoice-themed emails with PDF attachments and OneDrive-hosted JavaScript led to WasabiSeed and Screenshotter. Proofpoint first tracked Rhadamanthys in December 2022 in a campaign attributed to TA571, with post-exploitation attributed to TA866. TA571 is affiliated in reporting with infrastructure and services around 404TDS; one report states Vacant Viper is known to affiliate with TA571 and that 404TDS delivered IcedID and other malware. Proofpoint observed TA571 activity decrease or disappear from email campaign data since mid-2024.