TA551

Introduction

TA551 is a financially-motivated threat group that has been active since at least 2018. Secureworks GOLD CABIN The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. Unit 42 TA551 Jan 2021

Activities and Tactics

Information pending cataloguing.

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1218.010 Regsvr32
• T1589.002 Email Addresses
• T1204.002 Malicious File
• T1218.011 Rundll32
• T1027.003 Steganography
• T1566.001 Spearphishing Attachment
• T1132.001 Standard Encoding
• T1568.002 Domain Generation Algorithms
• T1027.010 Command Obfuscation
• T1071.001 Web Protocols
• T1105 Ingress Tool Transfer
• T1218.005 Mshta
• T1059.003 Windows Command Shell
• T1036 Masquerading

ATT&CK technique IDs (denormalized)

• T1027.003
• T1027.010
• T1036
• T1059.003
• T1071.001
• T1105
• T1132.001
• T1204.002
• T1218.005
• T1218.010
• T1218.011
• T1566.001
• T1568.002
• T1589.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• QakBot (S0650) — malware
• IcedID (S0483) — malware
• Valak (S0476) — malware
• Sliver (S0633) — tool
• Ursnif (S0386) — malware

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [4] Unit 42 Valak July 2020 Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020. [5] Unit 42 TA551 Jan 2021 Duncan, B. (2021, January 7). TA551: Email Attack Campaign Switches from Valak to IcedID. Retrieved March 17, 2021. [6] Secureworks GOLD CABIN Secureworks. (n.d.). GOLD CABIN Threat Profile. Retrieved March 17, 2021.