TA584

Executive Summary

TA584, also known as Storm‑0900 and UNC4122, is a high-volume initial access broker that targets a broad range of sectors worldwide using macro‑enabled Office attachments, brand impersonation, and rapid campaign churn. The group recently added the Tsundere Bot malware family and expanded its geographic scope to include Germany and Australia while maintaining operations in North America. Financial gain remains the primary motivation, with attacks designed for quick credential harvests and potential ransomware delivery.

Goals & Targeting

TA584’s strategic objective is primarily financial gain through large‑scale credential theft, phishing‑based initial compromise, and opportunistic ransomware deployments. The actor targets a diversified portfolio of sectors—including government agencies, defense contractors, educational institutions, media outlets, and healthcare providers—to maximize attack surface and potential payout. Geographically, TA584 has maintained a presence in the United States and Europe while recently expanding operations to Australia, Germany, Poland, Russia, Japan, and other markets. By rapidly rotating brand lures, localized content, and delivery vectors, the group avoids pattern recognition and increases the likelihood of successful compromise across diverse organizations.

Key Capabilities

• email-based phishing
• social engineering
• brand impersonation with localized content
• macro‑enabled Office documents for initial delivery
• ClickFix social engineering platform use
• customized physical mail imagery to increase believability
• rapid campaign churn with short lifespans
• delivery via compromised legitimate accounts (hundreds per wave)
• redirect chains and intermediary landing pages to obscure final payload location
• compromised domains
• Amazon S3 URL hosting
• Blogspot URLs in lure content
• TDS filtering services such as Cookie Reloaded, Keitaro, 404
• geographic targeting strategy with rotational focus on specific regions
• fake video game installers and web injects via RMMs
• backdoor loader with potential ransomware capabilities
• impersonates legitimate entities (e.g., ADP) in phishing emails
• email lure attacks

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

TA584’s campaign cadence demonstrates a high‑volume, hit‑and‑miss approach: each wave harnesses thousands of compromised legitimate accounts to distribute macro‑enabled email attachments and malicious URLs. Attackers rotate brand identities daily or weekly, localizing content linguistically to match targeted regions and ensuring that the same host appears fresh with every new phishing burst. The group’s infrastructure layers include third‑party TDS services, cloud storage on Amazon S3, and user‑generated Blogspot pages, all fed through redirect chains that dynamically change query strings—a tactic that hampers static IOC correlation. Notable operations have seen the actor impersonate well‑known payroll service ADP or use customized physical mail photos to increase realism. The new Tsundere Bot and XWorm variants hint at a strategic shift toward ransomware payloads, suggesting an escalation in monetary focus while maintaining low cost of acquisition via compromised accounts.

IOC Patterns

• customized physical mail photo attachments including recipient name and address
• email addresses from compromised individual senders with multiple display names per campaign matching lure content
• landing page design per campaign using distinct brands and localized languages
• short-lived brand usage in email content to target specific geographies
• URL download URLs with unique query strings (e.g., domain.tld/bbb/[unique_query])
• Use of Amazon S3 bucket URLs
• Blogspot domain references
• Third‑party TDS services such as Cookie Reloaded, Keitaro, 404
• Redirect chains through compromised domains
• Dynamic URL changes per campaign
• spoofed ADP email addresses
• email lure attack

Recommended Actions

• Monitor and correlate sender domains, display names, and delivery infrastructure for anomalous patterns rather than relying solely on static content filters
• Implement user awareness training focused on brand impersonation and customized mail images
• Deploy multi‑layered email security (attachment sandboxing, link scanning, reputation checks) to detect malicious URLs or docs from compromised accounts
• Track distribution of Tsundere Bot across endpoints and block known indicator signatures
• Use holistic campaign analysis tools that assess sender behaviour, infrastructure, and downstream execution
• Disable or tightly control macros in corporate Office environments
• Implement URL filtering and reputation checks for suspicious domains (e.g., AWS S3, Blogspot, TDS providers), Enforce email gateway scanning for spearphishing attachments and embedded redirect chains
• Monitor endpoints for indicators of XWorm or Tsundere Bot activity, including backdoor connections and potential ransomware behaviour

Suggested Tags