Loading threat actor…
TA582 is a financially motivated cybercrime operator tracked by Mandiant as UNC4108 and associated with the GhostWeaver malware ecosystem. The actor functions primarily as a post-exploitation and malware-delivery operator rather than a standalone initial access broker, and has been observed operating downstream of large-scale web-based infection chains including SocGholish and the TAG-124/KongTuke traffic distribution ecosystem. TA582 has also been linked to use of MintsLoader as a delivery and profiling component that filters victims and withholds primary payloads from likely sandbox environments. TA582 is notably associated with GhostWeaver, a fileless in-memory PowerShell remote access trojan that uses custom TLS-wrapped communications, multiple domain generation algorithms, and antivirus-aware persistence logic. GhostWeaver supports reflective plugin loading and has capabilities including browser credential theft, Outlook data theft, cryptocurrency wallet theft, web injection through a man-in-the-middle proxy model, and redeployment of loader components back onto compromised hosts. Its persistence framework has been observed using scheduled-task persistence, privilege escalation via a CMSTPLUA COM bypass, process metadata masquerading, and measures intended to reduce forensic visibility. Operationally, TA582 relies on socially engineered execution chains delivered through compromised websites, fake browser update lures, and ClickFix-style prompts that induce victims to run obfuscated PowerShell. The actor’s tooling demonstrates strong defense evasion, including sandbox scoring based on virtualization and hardware characteristics, AMSI bypass techniques, in-memory execution, obfuscation, direct use of public DNS resolvers to bypass enterprise controls, and rapid staged payload delivery. Reporting places TA582 among multiple downstream customers of shared traffic distribution and malware delivery services, indicating a service-based criminal ecosystem rather than an isolated intrusion set. Known aliases include UNC4108.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
26 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
33 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an APT customer of KongTuke's infection distribution service.
Operator attributed to the GhostWeaver fileless PowerShell RAT activity, delivered downstream of the SocGholish fake browser update infection chain; uses sandbox-aware delivery (MintsLoader profiling), AV-aware persistence selection, fileless in-memory execution, DGA-based C2 with direct queries to public DNS resolvers, and TLS C2 on a non-standard port.
Post-exploitation operator within the TAG-124 TDS ecosystem. Runs downstream activity after initial access, including MintsLoader victim scoring/profiling, DGA infrastructure, GhostWeaver (Pantera) deployment, and delivery of a PowerShell persistence installer; uses sandbox evasion to deliver decoys to analysis environments and real payloads to low-score (real) machines.
A named activity cluster assessed to leverage TAG-124 as a delivery component in initial infection chains.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.