Threat Actor Characterization
TA577
ID: 4177a76e7299ce14d383074bf5dc1aa457090Actor Network Graph
Open Network GraphMITRE ATT&CK®
TA577 is a prolific, email-focused initial access broker that historically distributed QakBot and, after the 2023 takedown, pivoted to Pikabot and early Latrodectus campaigns; in March 2024 it added forced-authentication flows to steal NTLM credentials.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566.002 | Spearphishing Link | TA0001 |
|
| T1204.001 | Malicious Link | TA0002 | |
| T1187 | Forced Authentication | TA0006 | |
| T1027.009 | Embedded Payloads | TA0005 |
CLASSIFICATION: Unclassified / Open Source
Executive Summary
TA577 is a financially motivated, email-centric threat actor tracked by Proofpoint as an initial-access broker (IAB). Historically one of the most active QakBot affiliates, the group pivoted to Pikabot after the August 2023 QakBot takedown and was among the first observed to distribute the Latrodectus loader in late 2023. attack.mitre.org+3Red Canary+3Proofpoint+3 Throughout 2023–2025, TA577 relied on large-scale phishing and thread hijacking, delivering loaders such as IcedID/Ursnif in prior waves and later Pikabot/Latrodectus, with frequent packaging shifts (LNK, ISO, HTML/JS, CHM, OneNote). Proofpoint In March 2024, Proofpoint documented a notable technique pivot: campaigns crafted to steal NTLM authentication information via forced authentication flows—expanding beyond pure loader delivery. Proofpoint+1 Overall assessment: TA577 demonstrates adaptable delivery tradecraft, rapid payload substitution, and credible capacity to seed follow-on access for ransomware affiliates. Confidence: high for payload/use history; medium for specific initial-access vectors per campaign.
- Industries/Sectors: Broad enterprise targeting typical of crimeware IABs (finance, manufacturing, professional services, government, education), with lures tailored to business workflows (reply-chains, invoices, HR, shipping). INFERENCE (confidence: medium) based on multi-vertical telemetry in public reporting of the delivered families.
- Geography (Region): Global distribution observed by vendors; campaigns routinely span North America and Europe. INFERENCE (confidence: medium).
- Countries (if available): Not consistently constrained; global.
- Timeframe: At least 2021–2025 (distinct payload phases across 2021–2025).
- Orientation/Motive: Profit-driven access brokering for downstream crimeware/ransomware operations. INFERENCE (confidence: high).
- Typical tradecraft: High-volume email, thread-hijacking, link- and attachment-based delivery, staging to loaders (QakBot→Pikabot/Latrodectus), experimentation with file formats, occasional identity-centric objectives (NTLM theft).
- Umbrella affiliations: Not publicly claimed; overlaps stem from payload ecosystems (e.g., QakBot, IcedID, Pikabot, Latrodectus) used by multiple crews. INFERENCE (confidence: medium).
Executive Analyst Brief for CISO
What: TA577 (IAB) delivers loaders (historically QakBot; later Pikabot/Latrodectus) via thread-hijacked email and link/attachment chains; in 2024 it added NTLM forced-auth credential theft.