TA570

Executive Summary

TA570, also known as DEV-0450, is a prominent cybercrime threat actor associated with the Qbot malware family. Active since at least 2018, TA570 has been linked to several high-profile campaigns targeting financial institutions and other industries. The group primarily relies on banking Trojans and phishing activities to achieve its objectives, making it a significant threat to global enterprises.

Goals & Targeting

TA570's strategic objectives appear to be primarily financially motivated, focusing on extracting sensitive information such as banking credentials and facilitating unauthorized transactions. The group's targeting profile includes financial institutions, retail sectors, and other organizations with accessible financial systems. TA570 often uses phishing campaigns and malware distribution to gain initial access to victim networks, enabling subsequent lateral movement and data exfiltration.

TA570 is one of the most active affiliates in the Qbot malware ecosystem, known for its sophisticated banking Trojan campaigns. This threat actor has been operational since 2018, primarily targeting financial institutions, retail sectors, and other industries with high monetary value. The group's primary modus operandi involves phishing emails, credential theft, and unauthorized wire transfers. TA570 has demonstrated a high level of technical expertise, leveraging Qbot's capabilities to deploy malicious payloads, bypass security measures, and execute large-scale financial fraud. The actor's activities have been observed globally, with a particular focus on North America, Europe, and Asia Pac regions.

Key Capabilities

• Qbot malware deployment for credential theft
• Phishing campaigns leveraging email as an infection vector
• Banking Trojan activities targeting financial institutions
• Unauthorised wire transfers and BEC (Business Email Compromise) techniques
• SMB protocol abuse for lateral movement
• RDP brute force attacks for initial access
• C2 communication via HTTP/HTTPS proxies

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

TA570 has been involved in multiple campaigns targeting financial institutions, using phishing as the primary entry vector. The group's operational tempo is high, with frequent campaigns often synchronized with global business hours. Notable past operations include large-scale wire fraud attempts and BEC attacks targeting corporate accounts. TA570 frequently adapts its tactics to evade detection, including updating Qbot's configurations and leveraging new domains for C2 communication.

IOC Patterns

• Qbot malware instances targeting Windows systems
• Phishing emails with malicious links or attachments mimicking financial institutions
• C2 communications over legitimate-looking domains (e.g., banking.mailservice.com)
• SMB protocol traffic between compromised machines
• RDP brute force activity from known TA570 IP addresses

Recommended Actions

• Implement network monitoring for Qbot-related IOC patterns and SMB/RDP traffic anomalies.
• Regularly patch and update software to mitigate known vulnerabilities exploited by Qbot.
• Enforce multi-factor authentication (MFA) for financial transactions and critical systems.
• Educate employees on identifying phishing emails and suspicious communication.
• Deploy endpoint detection and response (EDR) solutions to detect and block Qbot payloads.
• Monitor for unauthorized wire transfers and implement additional layers of verification.
• Review and secure RDP access, disabling it where unnecessary.

Suggested Tags