TA577

Introduction

TA577 is an initial access broker (IAB) that has distributed QakBot and Pikabot, and was among the first observed groups distributing Latrodectus in 2023. Latrodectus APR 2024

Activities and Tactics

Country of Origin: 🇷🇺 Russia

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1059.007 JavaScript
• T1059.003 Windows Command Shell
• T1027.009 Embedded Payloads
• T1586.002 Email Accounts
• T1204.001 Malicious Link
• T1566.002 Spearphishing Link

ATT&CK technique IDs (denormalized)

• T1027.009
• T1059.003
• T1059.007
• T1204.001
• T1566.002
• T1586.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

• Smoke Loader
• CyberGate
• Cyber Eye RAT
• GraphicBooting
• Cobalt Strike
• CrossRat

MITRE ATT&CK Software

• Pikabot (S1145) — malware
• QakBot (S0650) — malware
• Latrodectus (S1160) — malware

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [2] Latrodectus APR 2024 Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.