TA551

TA551 is a cybercrime threat actor tracked by Proofpoint since 2016. It is also known as Shathak, Gold Cabin, Monster Libra, and Mario Kart. The actor is responsible for distributing a wide variety of malware families, including Ursnif, IcedID, Valak, Qbot, Emotet, and more recently BazarLoader. Proofpoint describes TA551 as a malware distributor that frequently leverages thread hijacking to send malicious email attachments, including password-protected ZIP files and malicious Office documents, with broad geographic and industry targeting. TA551 has repeatedly used spearphishing attachments that prompt users to enable macros to install malware. Reported tradecraft in the provided content includes use of HTTP for command-and-control, encoded ASCII text for initial C2 communications, cmd.exe for command execution, regsvr32 in delivery chains, and use of the Sliver post-exploitation framework in 2021, with additional Sliver campaigns observed in 2022. In one described BazarLoader campaign, TA551 used malspam with a password-protected ZIP containing a macro-enabled Word document that wrote an HTA file from hidden document text, launched obfuscated script content, downloaded a payload over HTTP, and executed it via regsvr32. In a November 2022 intrusion described in the content, TA551 is assessed as the malware distributor that delivered IcedID via a thread-hijacked phishing email and HTML smuggling chain that preceded Nokoyawa ransomware deployment by a separate hands-on-keyboard actor. Proofpoint also assessed with high confidence that TA551 IcedID implants were associated with Maze and Egregor ransomware events in 2020.