TA530

🔴 High
Also known as: TA530

TA530, who we previously examined in relation to large-scale personalized phishing campaigns

🌍 Country China
⚡ Risk Level High

Associated Operations

2016-11 August in November: New Information Stealer Hits the Scene https://www.proofpoint.com/uk/threat-insight/post/august-in-december-new-information-stealer-hits-the-scene

Introduction

TA530, who we previously examined in relation to large-scale personalized phishing campaigns

Activities and Tactics

Country of Origin: 🇨🇳 China

Risk Level: High

Notable Campaigns

  • 2016-11
  • August in November: New Information Stealer Hits the Scene
  • https://www.proofpoint.com/uk/threat-insight/post/august-in-december-new-information-stealer-hits-the-scene

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • AbaddonPOS:
  • August Stealer:
  • CryptoWall:
  • Dridex:
  • Gozi ISFB:
  • H1N1 Loader:
  • Nymaim:
  • Smoke Loader:
  • TeamSpy:
  • TinyLoader:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.