TA577
· Published 16/12/2025 19:39 · Modified 27/03/2026 01:13
· Source: The MITRE Corporation
Essential information
- Confidence
- 100/100
- Published
- 16/12/2025 19:39
- Modified
- 27/03/2026 01:13
- Updated at
- 27/03/2026 01:13
- Revoked
- No
- Author / Source
- The MITRE Corporation
- Resource level
- —
- Primary motivation
- —
- Related entities
- 1 reports, 33 attack patterns (mitre), 11 malware, 2 sectors, 123 indicators
Description
[TA577](https://attack.mitre.org/groups/G1037) is an initial access broker (IAB) that has distributed [QakBot](https://attack.mitre.org/software/S0650) and [Pikabot](https://attack.mitre.org/software/S1145), and was among the first observed groups distributing [Latrodectus](https://attack.mitre.org/software/S1160) in 2023.(Citation: Latrodectus APR 2024)
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.
Reports (1)
-
20 MITREs 2 Malwares 76 Observables 1 APT
Attack patterns (MITRE) (33)
-
T1586.002 usesEmail Accounts MITRE
-
T1053.005 usesScheduled Task MITRE
-
T1059.007 usesJavaScript MITRE
-
T1059.005 usesVisual Basic MITRE
-
T1059.001 usesPowerShell MITRE
-
T1110 usesBrute Force MITRE
-
T1135 usesNetwork Share Discovery MITRE
-
T1059.003 usesWindows Command Shell MITRE
-
T1573.002 usesAsymmetric Cryptography MITRE
-
T1204 usesUser Execution MITRE
-
T1059 usesCommand and Scripting Interpreter MITRE
-
T1027 usesObfuscated Files or Information MITRE
Malware (11)
-
Latrodectus usesThe MITRE Corporation Confidence 100
[Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed…
First seen 01/01/1970 · Last seen 16/11/5138 · -
QakBot usesFamily
-
NETWIRE uses
-
DOUBLEBACK uses
-
AsyncRAT usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Matanbuchus usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Pikabot usesFamily
-
XWorm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SocGholish usesThe MITRE Corporation Confidence 100
[SocGholish](https://attack.mitre.org/software/S1124) is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Redline usesFamily
-
Quasar usesFamily
Sectors (2)
-
Education targets
-
Manufacturing targets
Indicators (123)
-
a748f4e526c1a5fed7e57887ef951e451236ee3ad39cf6161d18e5c2230aca0bindicates -
stnicholaschurch.caindicates -
http://89.117.2.33/7ipw/7ohq.txtindicates -
codezian.comindicates -
e1d34ad42938a777d80f3ee4c206de14021f13ab79600168b85894fdb0867b3eindicates -
988skins.comindicates -
0b0c70ee1612139cf7a83847cca805689aec9fbcc587a7ef8f26aa4fb9e71295indicates -
reykh.icuindicates -
8276104d8d47def986063b8fbafd82ad5f4cd23862ff9ede1231cefb35115a1bindicates -
democraticags.orgindicates -
barricks.orgindicates