Threat Actor Characterization
TA578
ID: 7c3997c8dc0bad89bccc6b369497edf256712Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
|
e9d61f40d2b614c195bed6dba40fb6bf78237 | Bumblebee | Unknown | related | Crimeware |
|
|
7e9fc934d2076e4e26746c5f2c17e73c11322 | IcedID Botnet | Unknown | related | Darkweb Market/Service |
|
|
b9766a6c547b117ef78f337aa938295829253 | Ursnif | Unknown | related | Crimeware |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
TA578 (G1038) is an email/contact-form phishing cluster active since 2020 that distributes loaders and stealers including IcedID, Bumblebee, and Latrodectus via reply-chain hijacks, malicious links and ISO attachments; campaigns enable credential theft and follow-on access.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566.002 | Spearphishing Link | TA0001 |
|
| T1204.001 | Malicious Link | TA0002 |
|
| T1566.001 | Spearphishing Attachment | TA0001 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1059 | Command and Scripting Interpreter | TA0002 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
TA578 (MITRE G1038) is a financially-motivated criminal activity cluster tracked by multiple vendors since 2020 that conducts email-based and contact-form campaigns to deliver malware loaders and stealers — historically including IcedID, Ursnif, Bumblebee, BazaLoader, Buer, and, more recently, the Latrodectus loader. The actor uses thread-hijacked reply-chains, phishing links, malicious attachments (including ISO files), and business-impersonation lures to compel victims to fetch or execute payloads. TA578’s campaigns have been observed delivering follow-on tooling such as Cobalt Strike and commodity stealers; vendors document sustained activity from 2020–2025. Confidence in these operational facts: high.
- Industries / Sectors: Broad — observed targets include enterprise and government recipients across multiple verticals (TA578 uses opportunistic phishing themes such as copyright, legal notices, stolen images and business contact).
- Geography (Region): Global — campaigns observed across EMEA, APAC and the Americas; distribution via email and public web contact forms.
- Timeframe: 2020-05 — 2025-05+ (tracking since mid-2020; Latrodectus use observed Nov 2023 onward; continued activity documented through 2025).