216.73.217.22

TA551

· Published 16/12/2025 19:39 · Modified 27/03/2026 01:14 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
27/03/2026 01:14
Updated at
27/03/2026 01:14
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
40 attack patterns (mitre), 5 malware, 15 indicators, 1 tool

Aliases

GOLD CABIN Shathak

Description

[TA551](https://attack.mitre.org/groups/G0127) is a financially-motivated threat group that has been active since at least 2018. (Citation: Secureworks GOLD CABIN) The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. (Citation: Unit 42 TA551 Jan 2021)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Attack patterns (MITRE) (40)

Malware (5)

  • Valak
  • Nokoyawa
  • QakBot uses
    Family
    Published 30/05/2024 14:20 · Modified 30/05/2024 14:20
  • IcedID uses
    Family
    Published 29/04/2024 19:15 · Modified 29/04/2024 19:15
  • PE_URSNIF uses
    Family
    Published 05/06/2026 18:07 · Modified 05/06/2026 18:07

Indicators (15)

Tool (1)

  • Sliver uses
    The MITRE Corporation Confidence 100

    [Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional …

    Published 30/07/2021 17:43 · Modified 27/03/2026 01:07