TA578
TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--a5cfbc79-316c-42f2-915d-6e8fef4085f8
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:29+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (4)
Adversaries may abuse various implementations of JavaScript for execution. JavaScript (JS) is a platform-independent scripting language (compiled just
An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to cl
Adversaries may search websites owned by the victim for information that can be used during targeting. Victim-owned websites may contain a variety of
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web
Software & Tools (3)
Bumblebee is a custom loader written in C++ that has been used by multiple threat actors, including possibl
IcedID is a modular banking malware designed to steal financial information that has been observed in the w
Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute
Explore this actor's full graph with Ninja Signal