MITRE ATT&CKgroup
G0127 TA551
- Domain
- enterprise
- Aliases
- GOLD CABIN, Shathak
- Version
- 1.2
- Created
- 2021-03-19
Description
TA551 is a financially-motivated threat group that has been active since at least 2018. The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns.
Related
Uses · MITRE ATT&CK (19)
- T1027.010 Command Obfuscation sub-technique
- S0650 QakBot software (malware)
- S0633 Sliver software (tool)
- T1589.002 Email Addresses sub-technique
- S0483 IcedID software (malware)
- S0476 Valak software (malware)
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1204.002 Malicious File sub-technique
- T1568.002 Domain Generation Algorithms sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1027.003 Steganography sub-technique
- T1218.005 Mshta sub-technique
- T1218.010 Regsvr32 sub-technique
- T1218.011 Rundll32 sub-technique
- S0386 Ursnif software (malware)
- T1036 Masquerading technique
- T1105 Ingress Tool Transfer technique
References
- https://unit42.paloaltonetworks.com/valak-evolution/ Unit 42 Valak July 2020
- https://unit42.paloaltonetworks.com/ta551-shathak-icedid/ Unit 42 TA551 Jan 2021
- https://www.secureworks.com/research/threat-profiles/gold-cabin Secureworks GOLD CABIN