Also known as: APT28, Pawn Storm, Fancy Bear, Sednit, Snake, BokBot, Asylum Ambuscade, ClickFix, malvertising, quishing, UNC961, UNC1860, Scarred Manticore, Storm-0861
TA571 is a spam distributor actor known for delivering a variety of malware, including DarkGate, NetSupport RAT, and information stealers. They use phishing emails with macro-enabled attachments to spread malicious PDFs containing rogue OneDrive links. TA571 has been observed using unique filtering techniques with intermediary "gates" to target specific users and bypass automated sandboxing. Proofpoint assesses with high confidence that TA571 infections can lead to ransomware.
Targeted Sectors
Targeted Countries / Regions
No AI analysis yet.
No campaigns linked yet.
No observed data linked yet.
17
Techniques
40
Tools
0
Campaigns
39
IOCs
0
Observed Data
5
Tactics