TA558.2

TA558.2 is a threat cluster associated with campaigns delivering Snake Keylogger, a Russian-origin .NET information stealer offered through a malware-as-a-service model. The cluster has been linked to campaigns against Ukraine and has also used topical geopolitical lures tied to oil markets and Middle East tensions, including impersonation of an oil company to entice victims into opening spearphishing attachments. Reported victim categories include companies, governments, and individuals, with indications of interest in energy-related targets. Operationally, TA558.2 has used spearphishing emails carrying archive attachments that launch a multi-stage infection chain. A notable characteristic is abuse of a legitimate Java debugging utility for DLL sideloading, loading a malicious library that ultimately deploys Snake Keylogger. The payload has been observed using process injection into a legitimate Windows utility and establishing persistence through autorun mechanisms in the user context. The operation also employed tampering of a DLL structure to hinder detection. The Snake Keylogger activity associated with TA558.2 focuses on credential theft and information collection. Observed capabilities include harvesting passwords from numerous web browsers and applications, collecting host network and geolocation information through external web services, and gathering system details such as the Windows product key. Exfiltration has been conducted over SMTP. The repeated use of the same sideloading pattern across multiple related samples suggests a coordinated and recognizable tradecraft profile for this cluster.