TA542
TA542, also known as Mummy Spider, is a prolific cybercrime threat actor tracked by Proofpoint as the operator and distributor of Emotet (also known as Geodo). Proofpoint reports tracking the actor since 2014, with large-scale international email campaigns affecting North America, Central America, South America, Europe, Asia, and Australia. The group is described as the gang that developed, distributes, and operates the Emotet botnet, and has been highlighted in public reporting as a Russian-aligned cybercrime group. TA542 is known for very high-volume malspam campaigns, often sending hundreds of thousands to millions of messages per campaign. Its delivery activity has commonly relied on Microsoft Word or Excel documents containing VBA or XL4 macros, malicious URLs, and compromised websites including WordPress sites. Proofpoint also observed TA542 adapting delivery methods over time, including use of XLL files, zipped LNK attachments, and other non-macro formats as macro blocking increased. The actor uses social engineering extensively, including invoice, payment, quote, purchase-order, and COVID-19-themed lures, stolen branding, language localization, and thread hijacking. Since early April 2019, TA542 has consistently used thread hijacking by replying to existing benign email conversations. Emotet is described in the content as having evolved from a banking Trojan into a modular botnet and malware delivery platform. Reported Emotet capabilities include spamming, credential theft, email harvesting, and network spreading/lateral movement. TA542 consistently uses the latest Emotet version and has used Emotet to deliver additional malware. Payloads directly mentioned in the content include Qbot, TrickBot, IcedID, Gootkit, Zeus Panda, and Bumblebee. Proofpoint also observed IcedID Lite distributed as a follow-on payload in a TA542 Emotet campaign in November 2022. Targeting is broad rather than industry-specific in the cited reporting, with recurring focus on countries including Germany, the United Kingdom, the United States, Latin America, Japan, and others. Specific reporting cited high-volume campaigns impacting Japan in April 2019. TA542 activity has also shown seasonal spikes around holidays such as Christmas, Thanksgiving, Black Friday, and Cyber Monday. Known aliases in the provided content are TA542 and Mummy Spider.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇯🇵 Japan
Tradecraft
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
5 malware families attributed to this actor across reporting.
Observables
111 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with Emotet campaigns that delivered IcedID Lite as a follow-on payload; Proofpoint notes limited visibility into follow-on payload attribution.
TA542 is responsible for distributing Emotet malware via large-scale email campaigns, often using hijacked email threads or invoice-themed lures. They have recently resumed activity after a hiatus, updating their tactics and leveraging additional malware loaders such as IcedID and Bumblebee.
Conducted high-volume email campaigns delivering Emotet and adapted delivery methods amid Microsoft's macro-blocking changes, using VBA/XL4 macro documents and later XLL files and zipped LNK attachments.
Russian cybercriminal group highlighted in the alert as part of the broader Russian cyber threat landscape.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.