TA579

Executive Summary

TA579 is an active threat actor since August 2021, primarily known for deploying BazaLoader and IcedID malware. Targeting North American financial services and retail sectors, they use phishing campaigns to gain unauthorized access, aiming to steal sensitive data with financial motives.

Goals & Targeting

TA579’s primary objective appears to be financial gain through the theft of sensitive information and potential unauthorized transactions due to their targeting of financial services. By focusing on North American retail sectors, they may also seek personally identifiable information (PII) for fraudulent activities. Their victimology indicates a preference for industries rich in financial data, making them attractive targets for cybercriminal operations.

TA579 has been tracked by Proofpoint since August 2021, engaging in campaigns that deploy BazaLoader and IcedID malware. These tools are indicative of their focus on cybercrime activities, particularly targeting sectors handling financial information. The actor's operations suggest a strategic approach to selecting victims, likely for the purpose of financial gain. Their use of known malware frameworks indicates some level of operational maturity in executing campaigns, suggesting they aim to maximize the impact of their attacks within specific industries.

Key Capabilities

• Phishing campaign orchestration
• Deployment of BazaLoader and IcedID malware
• Staging infrastructure setup
• Credential theft via malware

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

TA579 has been observed leveraging phishing emails to deliver BazaLoader. Campaigns have targeted financial institutions in North America, suggesting a prolonged operational presence and focus on sectors with high financial yield potential. Their use of known malware frameworks without significant customizations may indicate reuse or purchase from other threat actors.

IOC Patterns

• Spear-phishing emails with malicious attachments
• Command-and-control (C2) communication via established servers
• Staging infrastructure using bulletproof hosting providers
• Presence of IcedID and BazaLoader indicators

Recommended Actions

• Implement email filtering to detect phishing attempts
• Deploy endpoint detection and response solutions
• Monitor for unusual activity in financial systems
• Educate employees on recognizing suspicious emails

Suggested Tags