TA577
· Published 16/12/2025 19:39 · Modified 27/03/2026 01:13
· Source: The MITRE Corporation
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 1 reports, 33 attack patterns (mitre), 11 malware, 2 sectors, 123 indicators
Description
[TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023.(Citation: Latrodectus APR 2024)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Reports (1)
-
20 MITREs 2 Malwares 76 Observables 1 APT
Attack patterns (MITRE) (33)
-
T1003 usesOS Credential Dumping MITRE
-
T1204.001 usesMalicious Link MITRE
-
T1497.001 usesSystem Checks MITRE
-
T1129 usesShared Modules MITRE
-
T1083 usesFile and Directory Discovery MITRE
-
T1566 usesPhishing MITRE
-
T1055 usesProcess Injection MITRE
-
T1078 usesValid Accounts MITRE
-
T1489 usesService Stop MITRE
-
T1219 usesRemote Access Tools MITRE
-
T1547 usesBoot or Logon Autostart Execution MITRE
-
T1027.005 usesIndicator Removal from Tools MITRE
Malware (11)
-
Latrodectus usesThe MITRE Corporation Confidence 100
[Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed…
First seen 01/01/1970 · Last seen 16/11/5138 · -
QakBot usesFamily
-
NETWIRE uses
-
DOUBLEBACK uses
-
AsyncRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Matanbuchus usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Pikabot usesFamily
-
XWorm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SocGholish usesThe MITRE Corporation Confidence 100
[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Redline usesFamily
-
Quasar usesFamily
Sectors (2)
-
Education targets
-
Manufacturing targets
Indicators (123)
-
torontoclub.vipindicates -
377fe4e55b6dde063c15c41389f3bb5aacf95443874bdcc0d02a44d6bd793780indicates -
http://89.117.1.161/epxq/A.txtindicates -
http://89.117.2.34/4qp/8Y.txtindicates -
http://89.117.1.161/mtdi/ZQCw.txtindicates -
43f4eaefc6e71f8d30b2e3749475af51ce4d6740546706113cc4785b4410a14cindicates -
http://176.123.2.146/vbcsn/UOx.txtindicates -
newtryex.ddns.netindicates -
bdc52f8983b7f034e86d1628efab5faf974e8c33ea9c3bcab0fd09ca462f8322indicates -
su1d.nerdpol.ovhindicates -
75819879049e80de6376f146430e63a53fc4291d21f3db930ea872b82d07c77aindicates -
research.openanalysis.netindicates