TA551 - G0127

Created: 2021-03-19T21:04:00.692Z

Modified: 2023-03-22T05:40:21.255Z

Contributors: Shuhei Sasada, Cyber Defense Institute, Inc,Ryo Tamura, SecureBrain Corporation,Shotaro Hamamoto, NEC Solution Innovators, Ltd,Yusuke Niwa, ITOCHU Corporation,Takuma Matsumoto, LAC Co., Ltd

Aliases

TA551,GOLD CABIN,Shathak

Description

TA551 is a financially-motivated threat group that has been active since at least 2018. (Citation: Secureworks GOLD CABIN) The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. (Citation: Unit 42 TA551 Jan 2021)

Techniques Used

TA551 has used mshta.exe to execute malicious payloads.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

TA551 has prompted users to enable macros within spearphishing attachments to install malware.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

TA551 has sent spearphishing attachments with password protected ZIP files.(Citation: Unit 42 Valak July 2020)(Citation: Unit 42 TA551 Jan 2021)(Citation: Secureworks GOLD CABIN)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

TA551 has used

TA551 has used a DGA to generate URLs from executed macros.(Citation: Unit 42 TA551 Jan 2021)(Citation: Secureworks GOLD CABIN)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|