CybercrimeMITRE G1038
TA578
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
TA578, a threat actor that Proofpoint researchers have been tracking since May of 2020. TA578 has previously been observed in email-based campaigns delivering Ursnif, IcedID, KPOT Stealer, Buer Loader, BazaLoader, and Cobalt Strike.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1059.007 JavaScriptT1204.001 Malicious LinkT1583.006 Web ServicesT1594 Search Victim-Owned Websites
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming
- https://attack.mitre.org/groups/G1038
- https://www.bitsight.com/blog/latrodectus-are-you-coming-back
- https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.