the syndicate

Executive Summary

The Syndicate is a medium‑sophistication criminal group that runs large‑scale phishing and BEC campaigns to infiltrate over 500 000 organizations worldwide, deploying malicious documents to deliver ransomware such as Conti via Shathak (TA551). In addition to ransomware, the organization harvests payment‑card data, smuggles stolen devices, and launders profits through cross‑border transport operations managed on Telegram. Their operations span all major sectors—including finance, retail, health, defense, and critical infrastructure—across more than 150 countries.

Goals & Targeting

The primary objective of The Syndicate is monetary gain, accomplished through three interconnected channels: ransomware extortion (Conti, Shathak), credentialed payment‑card theft, and smuggling/laundering of high‑value goods. Their targeting is intentionally broad, encompassing financial services, retail, telecommunications, defense, pharmaceuticals, government entities, manufacturing, media, healthcare, transportation, utilities, food‑agriculture, IT, and critical infrastructure worldwide—especially in countries where regulatory enforcement may be uneven or fragmented.

Key Capabilities

• Large‑scale worldwide phishing and BEC campaigns targeting over 500 000 organizations
• Initial access via malicious document attachments delivering malware such as IcedID, Shathak (TA551), and other RATs
• Deployment of Cobalt Strike infrastructure for lateral movement and tool transfer
• Delivery of ransomware families like Conti through compromised infrastructure
• Supply‑chain style attacks embedding malware in purchase orders, product inquiries, and COVID‑19 aid emails
• Phishing targeting payment card and OTP credentials, including use of burn‑phone mules to hijack contactless payments
• Use of remote access trojans (CraxsRAT, Remcos, AsyncRAT) for device takeover and credential theft
• Asset smuggling, money laundering and cross‑border transport operations coordinated via Telegram channels

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The Syndicate’s campaigns are characterized by high throughput phishing, often deploying millions of spearphishing emails with malicious attachments or fake Android app downloads. Success rates appear to remain high due to the use of fresh domains and IPs, allowing rapid pivoting between victims. Targeted industries include both critical infrastructure and consumer‑facing sectors, reflecting a strategy that values both immediate extortion gains from ransomware and longer‑term revenue streams from payment‑card theft and physical smuggling operations. Recent publicized incidents—such as the Onslow North Carolina water attack, the Dataresolution.net MSP compromise, and 2023 fake Android app campaigns—highlight an operational tempo that averages multiple attacks per month across continents. Law‑enforcement disruptions have occasionally isolated segments of their infrastructure; however, residual operations continue to emerge, indicating a resilient supply‑chain and modular malware distribution model.

IOC Patterns

• Domain names of newly created Cobalt Strike‑related infrastructure
• IP addresses used for command-and-control servers
• Malicious document attachments in spearphishing emails
• Phishing emails with fake Android app downloads
• Compromised legitimate software update files
• Telegram channels for mule recruitment

Recommended Actions

• Implement comprehensive phishing and BEC awareness training for employees and third‑party vendors
• Deploy email filtering, attachment sandboxing, and advanced threat detection to block malicious documents and fake mobile apps
• Detect and block Cobalt Strike beacon traffic and lateral-tool transfer communications
• Block or monitor newly registered domains and IP addresses linked to the Syndicate’s infrastructure
• Enable endpoint protection with signatures for IcedID, Shathak (TA551), and other ransomware indicators
• Monitor network activity for RAT usage such as CraxsRAT, Remcos, AsyncRAT, and block lateral movement pathways
• Enforce multi‑factor authentication and monitor OTP interception attempts
• Verify supply‑chain communications and validate purchase order authenticity to detect malicious file injections
• Conduct asset tracking audits to identify smuggling or unauthorized device activation patterns

Suggested Tags