Hagga

Executive Summary

Hagga, also known as Aggah or TH-157, is an unidentified threat actor suspected of utilizing Agent Tesla since late 2021 to steal sensitive information from victims. The actor's primary activities appear to involve deploying this malware to infiltrate systems, with a focus on data exfiltration.

Goals & Targeting

Hagga's strategic objectives appear to center around financial gain through the theft of sensitive financial information and credentials, which could be used for fraudulent transactions or sold on the dark web. The targeting profile suggests a focus on individuals or organizations with accessible financial data, though specific sectors or countries targeted are not definitively known.

Hagga is believed to have emerged in the latter half of 2021, employing Agent Tesla—a prolific banking Trojan—in their operations. This malware primarily targets financial information and credentials, indicating that Hagga likely focuses on sectors where such data holds significant value, possibly including the financial sector and retail industries. Agent Tesla's deployment suggests a focus on phishing or social engineering tactics to infect systems, followed by stealthy information theft.

Key Capabilities

• Information stealing via malware deployment
• Phishing campaigns to distribute malicious payloads
• Persistence mechanisms for long-term access
• Credential theft and unauthorized financial transactions

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Hagga's campaigns are ongoing and appear to be associated with the use of Agent Tesla since late 2021. Specific campaign details, including targeted sectors or countries, remain unclear due to limited available intelligence.

IOC Patterns

• Use of phishing emails containing malicious links
• Distribution of malware via social engineering tactics

Recommended Actions

• Implement rigorous user training on phishing detection
• Enhance network monitoring for suspicious activities
• Apply endpoint detection and response solutions to identify and mitigate Agent Tesla-like activity

Suggested Tags