TA2536

Executive Summary

TA2536 is a cyber threat actor likely based in Nigeria, identified by unique linguistic patterns, tactics, and tools. Active since 2015, TA2536 targets financial and retail sectors globally, using keyloggers like HawkEye and distinctive typo-squatting domains to compromise victims.

Goals & Targeting

TA2536's objectives appear to be primarily financial, aiming to extract sensitive information and funds from targeted industries. The group’s choice of victims aligns with sectors where data breach or financial theft can yield significant monetary returns. By leveraging their unique linguistic and technical methods, TA2536 focuses on global organizations across multiple geographies, reflecting a patient and methodical approach to achieving long-term financial gain.

TA2536, first observed in activity as early as 2015, is believed to be based in Nigeria due to its linguistic style and operational methods. This group primarily focuses on financial gain through sophisticated cyberattacks targeting sectors with high monetary value such as banking, e-commerce, and financial services. TA2536 employs keyloggers, including the known HawkEye malware, and utilizes stylometric features in typo-squatting domains to mimic legitimate organizations. Their attack patterns, which include spear-phishing campaigns and email address substring reuse, indicate a focus on persistent, financially motivated cyber operations.

Key Capabilities

• Keylogger deployment (e.g., HawkEye)
• Typo-squatting domain registration
• Stylometric analysis for phishing campaigns
• Spear-phishing with email substring reuse

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

TA2536 has demonstrated sustained activity over several years, focusing on prolonged campaigns that target financially lucrative sectors. Their use of persistent techniques and custom tools suggests an evolved operational framework. Campaign patterns include patient hunting for high-value targets within the financial sector, with a particular emphasis on compromising sensitive customer data.

IOC Patterns

• Spear-phishing emails with domain typosquatting
• Recurring email substring reuse
• Keylogger activity linked to HawkEye malware

Recommended Actions

• Implement multi-factor authentication (MFA) for critical systems and financial transactions
• Educate employees about phishing tactics and stylometric anomalies in emails
• Monitor network traffic for Indicators of Compromise related to TA2536's TTPs

Suggested Tags